PT-2018-9257 · Roundcube+2 · Roundcube+2

Published 2018-03-13 · Updated 2026-03-30 · CVE-2018-1000071

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: roundcube versions 1.3.4 and earlier

Description: The issue concerns a problem with insecure permissions in the enigma plugin, which can lead to the exfiltration of the gpg private key. This can be exploited through network connectivity.

Recommendations: For roundcube versions 1.3.4 and earlier, consider disabling the enigma plugin as a temporary workaround until a patch is available. Restrict access to the enigma plugin to minimize the risk of exploitation. Avoid using the enigma plugin via network connectivity until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

ALT-PU-2018-1778

CVE-2018-1000071

USN-8132-1

Affected Products

Alt Linux

Roundcube

Ubuntu

References · 20

• 🔥 https://legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt · Exploit
• https://ubuntu.com/security/CVE-2018-1000071 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6820 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8132-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10740 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-1000071 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-4069 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000071 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8132-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1000071 · Security Note
• https://ubuntu.com/security/CVE-2016-4068 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000071 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-8114 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000071 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-19205 · Vendor Advisory