Описание
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.
Ссылки
- Patch
- Patch
- Patch
- Patch
- Release Notes
- Release Notes
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 1.6.0 (включая) до 1.6.17 (исключая)Версия от 1.7.0 (включая) до 1.7.2 (исключая)
Одно из
cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
EPSS
Процентиль: 18%
0.00259
Низкий
6.4 Medium
CVSS3
9.8 Critical
CVSS3
Дефекты
CWE-290
Связанные уязвимости
CVSS3: 6.4
ubuntu
23 дня назад
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.
CVSS3: 6.4
debian
23 дня назад
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the passwor ...
CVSS3: 6.4
github
22 дня назад
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.
EPSS
Процентиль: 18%
0.00259
Низкий
6.4 Medium
CVSS3
9.8 Critical
CVSS3
Дефекты
CWE-290