CVE-2018-1000071

Опубликовано: 13 мар. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.

Ссылки

https://github.com/roundcube/roundcubemail/issues/6173
Third Party Advisory
https://www.legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt
Exploit
Third Party Advisory
https://github.com/roundcube/roundcubemail/issues/6173
Third Party Advisory
https://www.legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*

Версия до 1.3.4 (включая)

EPSS

Процентиль: 52%

0.00291

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-732

Связанные уязвимости

CVE-2018-1000071

CVSS3: 7.5

ubuntu

почти 8 лет назад

CVE-2018-1000071

CVSS3: 7.5

debian

почти 8 лет назад

roundcube version 1.3.4 and earlier contains an Insecure Permissions v ...

GHSA-5jgp-7xfp-x54p

CVSS3: 7.5

github

больше 3 лет назад

EPSS

Процентиль: 52%

0.00291

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-732