PT-2015-4296 · Roundcube+1 · Roundcube Webmail+1

Published 2015-01-15 · Updated 2016-02-12 · CVE-2014-9587

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.0.4

Description The issue affects Roundcube Webmail, allowing remote attackers to hijack the authentication of victims via unknown vectors. This is related to address book operations or the ACL or Managesieve plugins.

Recommendations For versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the address book operations and the ACL or Managesieve plugins until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

ALT-PU-2016-1095

CVE-2014-9587

DLA-613-1

Affected Products

Alt Linux

Roundcube Webmail

References · 31

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2180 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9587 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8105 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8793 · Security Note
• https://bdu.fstec.ru/vul/2015-02661 · Security Note
• https://osv.dev/vulnerability/CVE-2014-9587 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6121 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4668 · Security Note
• https://bdu.fstec.ru/vul/2015-12012 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5645 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-9587 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6172 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3507 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-9587 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2016-1095 · Vendor Advisory