Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2013-1904

Опубликовано: 08 фев. 2014
Источник: nvd
CVSS2: 5
EPSS Низкий

Описание

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
Версия до 0.7.2 (включая)
cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.1:20050811:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.1:20050820:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.1:20051007:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.1:20051021:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.1:stable:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.2:stable:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.2.2:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.3:stable:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.5.1:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.5.2:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.5.3:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.5.4:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.6:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.7:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.7.1:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.8.1:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.8.2:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.8.3:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.8.4:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:0.8.5:*:*:*:*:*:*:*

EPSS

Процентиль: 56%
0.0034
Низкий

5 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

ubuntu логотип

CVE-2013-1904

ubuntu
почти 12 лет назад

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.

debian логотип

CVE-2013-1904

debian
почти 12 лет назад

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Ro ...

github логотип

GHSA-xhjq-9gfc-7x74

github
больше 3 лет назад

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.

EPSS

Процентиль: 56%
0.0034
Низкий

5 Medium

CVSS2

Дефекты

CWE-22