PT-2019-12017 · Roundcube+3 · Roundcube Webmail+3

Jensvoid · Publicado 2019-04-07 · Atualizado 2026-03-30 · CVE-2019-10740

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.3.10

Description The issue allows an attacker with S/MIME or PGP encrypted emails to craft a multipart email, hiding the encrypted parts using HTML/CSS or ASCII newline characters. When the receiver replies to this email, they may unknowingly leak the plaintext of the encrypted message parts back to the attacker.

Recommendations For versions prior to 1.3.10, update to version 1.3.10 or later to resolve the issue.

Exploit

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

ALT-PU-2019-2818

ALT-PU-2019-2946

CVE-2019-10740

OPENSUSE-SU-2020:1516-1

OPENSUSE-SU-2020_1516-1

OPENSUSE-SU-2022:10148-1

OPENSUSE-SU-2024:11303-1

USN-8132-1

Produtos afetados

Alt Linux

Roundcube Webmail

Suse

Ubuntu

Referências · 52

• 🔥 https://github.com/roundcube/roundcubemail/issues/6638 · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube · Exploit
• https://github.com/roundcube/roundcubemail/releases/tag/1.3.10 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10740 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-8114 · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/3WUL4HE7A5MLE433XPBQYBUU6265EYNA · Nota
• https://bugzilla.suse.com/1146286 · Nota
• https://ubuntu.com/security/CVE-2016-4068 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:11303-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-19206 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10740 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-8132-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-1000071 · Aviso do Fabricante