Описание
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | ignored | end of life |
| bionic | not-affected | 1.3.6+dfsg.1-1 |
| cosmic | not-affected | 1.3.6+dfsg.1-1 |
| devel | not-affected | 1.3.6+dfsg.1-1 |
| disco | not-affected | 1.3.6+dfsg.1-1 |
| eoan | not-affected | 1.3.6+dfsg.1-1 |
| esm-apps-legacy/xenial | released | 1.2~beta+dfsg.1-0ubuntu1+esm7 |
| esm-apps/bionic | not-affected | 1.3.6+dfsg.1-1 |
| esm-apps/focal | not-affected | 1.3.6+dfsg.1-1 |
| esm-apps/jammy | not-affected | 1.3.6+dfsg.1-1 |
Показывать по
Ссылки на источники
EPSS
6.5 Medium
CVSS2
8.8 High
CVSS3
Связанные уязвимости
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
Roundcube Webmail allows arbitrary password resets by authenticated us ...
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
ALT-PU-2017-1701: package `roundcube` update to version 1.2.5-alt1
EPSS
6.5 Medium
CVSS2
8.8 High
CVSS3