CVEvulnerability
CVE-2017-8114
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-04-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-269
Description
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
Affected configurations
• roundcube webmail (< 1.0.11)
• roundcube webmail (>= 1.1.0 < 1.1.9)
• roundcube webmail (>= 1.2.0 < 1.2.5)
Related
Weakness · CWE (1)
- CWE-269 Improper Privilege Management weakness
References
- http://www.securityfocus.com/bid/98445 Third Party Advisory, VDB Entry
- https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114 Exploit, Third Party Advisory
- https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11 Release Notes, Vendor Advisory
- https://security.gentoo.org/glsa/201707-11 Third Party Advisory
- http://www.securityfocus.com/bid/98445 Third Party Advisory, VDB Entry
- https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114 Exploit, Third Party Advisory
- https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11 Release Notes, Vendor Advisory
- https://security.gentoo.org/glsa/201707-11 Third Party Advisory