Vulnerability Details CVE-2017-8114
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.016
EPSS Ranking 80.5%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.5
References
- http://www.securityfocus.com/bid/98445
- https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114
- https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11
- https://security.gentoo.org/glsa/201707-11
- http://www.securityfocus.com/bid/98445
- https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114
- https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11
- https://security.gentoo.org/glsa/201707-11
Products affected by CVE-2017-8114
-
cpe:2.3:a:roundcube:webmail:-
-
cpe:2.3:a:roundcube:webmail:0.1
-
cpe:2.3:a:roundcube:webmail:0.1.1
-
cpe:2.3:a:roundcube:webmail:0.2
-
cpe:2.3:a:roundcube:webmail:0.2.1
-
cpe:2.3:a:roundcube:webmail:0.2.2
-
cpe:2.3:a:roundcube:webmail:0.3
-
cpe:2.3:a:roundcube:webmail:0.3.1
-
cpe:2.3:a:roundcube:webmail:0.4
-
cpe:2.3:a:roundcube:webmail:0.4.1
-
cpe:2.3:a:roundcube:webmail:0.4.2
-
cpe:2.3:a:roundcube:webmail:0.5
-
cpe:2.3:a:roundcube:webmail:0.5.1
-
cpe:2.3:a:roundcube:webmail:0.5.2
-
cpe:2.3:a:roundcube:webmail:0.5.3
-
cpe:2.3:a:roundcube:webmail:0.5.4
-
cpe:2.3:a:roundcube:webmail:0.6
-
cpe:2.3:a:roundcube:webmail:0.7
-
cpe:2.3:a:roundcube:webmail:0.7.1
-
cpe:2.3:a:roundcube:webmail:0.7.2
-
cpe:2.3:a:roundcube:webmail:0.7.3
-
cpe:2.3:a:roundcube:webmail:0.7.4
-
cpe:2.3:a:roundcube:webmail:0.8.0
-
cpe:2.3:a:roundcube:webmail:0.8.1
-
cpe:2.3:a:roundcube:webmail:0.8.2
-
cpe:2.3:a:roundcube:webmail:0.8.3
-
cpe:2.3:a:roundcube:webmail:0.8.4
-
cpe:2.3:a:roundcube:webmail:0.8.5
-
cpe:2.3:a:roundcube:webmail:0.8.6
-
cpe:2.3:a:roundcube:webmail:0.8.7
-
cpe:2.3:a:roundcube:webmail:0.9
-
cpe:2.3:a:roundcube:webmail:0.9.0
-
cpe:2.3:a:roundcube:webmail:0.9.1
-
cpe:2.3:a:roundcube:webmail:0.9.2
-
cpe:2.3:a:roundcube:webmail:0.9.3
-
cpe:2.3:a:roundcube:webmail:0.9.4
-
cpe:2.3:a:roundcube:webmail:0.9.5
-
cpe:2.3:a:roundcube:webmail:1.0
-
cpe:2.3:a:roundcube:webmail:1.0.0
-
cpe:2.3:a:roundcube:webmail:1.0.1
-
cpe:2.3:a:roundcube:webmail:1.0.10
-
cpe:2.3:a:roundcube:webmail:1.0.2
-
cpe:2.3:a:roundcube:webmail:1.0.3
-
cpe:2.3:a:roundcube:webmail:1.0.4
-
cpe:2.3:a:roundcube:webmail:1.0.5
-
cpe:2.3:a:roundcube:webmail:1.0.6
-
cpe:2.3:a:roundcube:webmail:1.0.7
-
cpe:2.3:a:roundcube:webmail:1.0.8
-
cpe:2.3:a:roundcube:webmail:1.0.9
-
cpe:2.3:a:roundcube:webmail:1.1.0
-
cpe:2.3:a:roundcube:webmail:1.1.1
-
cpe:2.3:a:roundcube:webmail:1.1.2
-
cpe:2.3:a:roundcube:webmail:1.1.3
-
cpe:2.3:a:roundcube:webmail:1.1.4
-
cpe:2.3:a:roundcube:webmail:1.1.5
-
cpe:2.3:a:roundcube:webmail:1.1.6
-
cpe:2.3:a:roundcube:webmail:1.1.7
-
cpe:2.3:a:roundcube:webmail:1.1.8
-
cpe:2.3:a:roundcube:webmail:1.2.0
-
cpe:2.3:a:roundcube:webmail:1.2.1
-
cpe:2.3:a:roundcube:webmail:1.2.2
-
cpe:2.3:a:roundcube:webmail:1.2.3
-
cpe:2.3:a:roundcube:webmail:1.2.4