PT-2005-5054 · Roundcube · Roundcube Webmail

Published 2005-12-20 · Updated 2018-10-19 · CVE-2005-4368

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Roundcube Webmail Alpha

Description The issue allows remote attackers to obtain the full path of the application via an invalid task parameter. This occurs when the default high verbose level is set, specifically with $rcmail config['debug level'] equal to 1. The path is leaked in an error message.

Recommendations For Roundcube Webmail Alpha, consider setting $rcmail config['debug level'] to a lower value to minimize the amount of information disclosed in error messages. As a temporary workaround, restrict access to the application to minimize the risk of path disclosure until a more permanent solution is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2005-4368

Affected Products

Roundcube Webmail

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2005-4368 · Security Note
• http://securityfocus.com/archive/1/422168/100/0/threaded · Note
• http://securityfocus.com/archive/1/419710/100/0/threaded · Note
• http://securityfocus.com/archive/1/418851/100/0/threaded · Note