PT-2023-23666 · Roundcube · Roundcube Password Recovery Plugin

Pedro José Navas Pérez · Published 2023-09-04 · Updated 2023-09-08 · CVE-2023-3222

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Password Recovery plugin for Roundcube version 1.2

Description The issue concerns the password recovery mechanism, which could allow a remote attacker to change an existing user's password by adding a 6-digit numeric token. Since the platform has no limit on the number of requests, an attacker could create an automatic script to test all possible values.

Recommendations For Password Recovery plugin for Roundcube version 1.2, consider disabling the password recovery feature until a patch is available to prevent exploitation. Restrict access to the password recovery mechanism to minimize the risk of unauthorized password changes. Avoid using the password recovery feature with the 6-digit numeric token until the issue is resolved.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2023-3222

Affected Products

Roundcube Password Recovery Plugin

References · 6

• https://osv.dev/vulnerability/CVE-2023-3222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3222 · Security Note
• https://twitter.com/cracbot/status/1698939084243362215 · Twitter Post
• https://t.me/cibsecurity/69790 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-roundcube-password-recovery-plugin · Note
• https://twitter.com/CVEnew/status/1698687256842674628 · Twitter Post