PT-2019-12017 · Roundcube+3 · Roundcube Webmail+3

Jensvoid · Published 2019-04-07 · Updated 2026-03-30 · CVE-2019-10740

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.3.10

Description The issue allows an attacker with S/MIME or PGP encrypted emails to craft a multipart email, hiding the encrypted parts using HTML/CSS or ASCII newline characters. When the receiver replies to this email, they may unknowingly leak the plaintext of the encrypted message parts back to the attacker.

Recommendations For versions prior to 1.3.10, update to version 1.3.10 or later to resolve the issue.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

ALT-PU-2019-2818

ALT-PU-2019-2946

CVE-2019-10740

OPENSUSE-SU-2020:1516-1

OPENSUSE-SU-2020_1516-1

OPENSUSE-SU-2022:10148-1

OPENSUSE-SU-2024:11303-1

USN-8132-1

Affected Products

Alt Linux

Roundcube Webmail

Suse

Ubuntu

References · 52

• 🔥 https://github.com/roundcube/roundcubemail/issues/6638 · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10740 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-4068 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11303-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-19206 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10740 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8132-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000071 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFFMSO5WKEYSGMTZPZFF4ZADUJ57PRN5 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-10740 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6820 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10740 · Vendor Advisory