PT-2017-4168 · Roundcube+2 · Roundcube Webmail+2
David67810
·
Published
2017-09-11
·
Updated
2026-03-12
·
CVE-2017-16651
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Roundcube Webmail versions prior to 1.1.10
Roundcube Webmail versions 1.2.x prior to 1.2.7
Roundcube Webmail versions 1.3.x prior to 1.3.3
Description
The issue is related to file-based attachment plugins and allows unauthorized access to arbitrary files on the host's filesystem, including configuration files. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue has been exploited in the wild in November 2017.
Recommendations
For Roundcube Webmail versions prior to 1.1.10, update to version 1.1.10 or later.
For Roundcube Webmail versions 1.2.x prior to 1.2.7, update to version 1.2.7 or later.
For Roundcube Webmail versions 1.3.x prior to 1.3.3, update to version 1.3.3 or later.
As a temporary workaround, consider disabling file-based attachment plugins until a patch is available.
Restrict access to the
task=settings& action=upload-display& from=timezone request to minimize the risk of exploitation.Exploit
Fix
Files Accessible to External Parties
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Roundcube Webmail
Ubuntu