PT-2013-1084 · Roundcube+1 · Roundcube Webmail+1
Publicado
2013-11-05
·
Atualizado
2024-06-15
·
CVE-2013-6172
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Roundcube webmail versions prior to 0.8.7
Roundcube webmail versions 0.9.x prior to 0.9.5
Description
The issue allows remote attackers to modify configuration settings via the
session parameter. This can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code. Multiple vulnerabilities in the Roundcube package may lead to disruption of confidentiality, integrity, and availability of protected information, and exploitation can be done remotely.Recommendations
For versions prior to 0.8.7, update to version 0.8.7 or later.
For versions 0.9.x prior to 0.9.5, update to version 0.9.5 or later.
As a temporary workaround, consider restricting access to the
session parameter to minimize the risk of exploitation.Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Roundcube Webmail