PT-2017-18124 · Roundcube+1 · Roundcube Webmail+1

Martino Sani · Publicado 2017-04-29 · Atualizado 2026-03-30 · CVE-2017-8114

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.0.11 Roundcube Webmail versions 1.1.x before 1.1.9 Roundcube Webmail versions 1.2.x before 1.2.5

Description The issue allows arbitrary password resets by authenticated users due to an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.

Recommendations For versions prior to 1.0.11, update to version 1.0.11 or later. For versions 1.1.x before 1.1.9, update to version 1.1.9 or later. For versions 1.2.x before 1.2.5, update to version 1.2.5 or later.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

ALT-PU-2017-1701

CVE-2017-8114

DLA-933-1

MGASA-2017-0181

OPENSUSE-SU-2024:11303-1

USN-8132-1

Produtos afetados

Alt Linux

Roundcube Webmail

Referências · 42

• 🔥 https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114 · Exploit
• https://github.com/roundcube/roundcubemail/releases/tag/1.0.11 · Nota
• https://github.com/roundcube/roundcubemail/commit/6e054a37d13dc3772d0aa454a32d5dc3bdcc7003 · Nota
• https://github.com/roundcube/roundcubemail/commit/271426429bfbb5b63e6dec91b1e4780e8ef1c67e · Nota
• https://github.com/roundcube/roundcubemail/releases/tag/1.2.5 · Nota
• https://github.com/roundcube/roundcubemail/releases/tag/1.1.9 · Nota
• https://github.com/roundcube/roundcubemail/commit/10b227d70a03e33682aaaa0138e84f9256f3cd50 · Nota
• https://security.gentoo.org/glsa/201707-11 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-8114 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-8114 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-6820 · Nota
• https://ubuntu.com/security/CVE-2018-9846 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-4069 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-10740 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-8132-1 · Aviso do Fabricante