CNVD-2016-12513 — Vulnetix

CNVD-2016-12513 PUBLISHED

Roundcube是一款基于浏览器的IMAP客户端（邮件客户端），它支持地址薄管理、信息搜索、拼写检查等。 Roundcube steps/mail/sendmail.inc存在任意代码执行漏洞。由于程序未能限制使用发件命令行上的自定义信封地址。远程攻击者可通过发送特制的HTTP请求利用该漏洞执行任意代码。

Affected Products

Vendor	Product	Versions
n/a	n/a	n/a

Timeline

Dec 8, 2016 CVE Published
Dec 12, 2016 CVE ID Reserved
Jun 25, 2026 Security Advisory

References

https://blog.ripstech.com/2016/roundcube-command-execution-via-email/ url
94858 vdb
[oss-security] 20161208 roundcube code execution via mail() mailing-list
https://roundcube.net/news/2016/11/28/updates-1.2.3-and-1.1.7-released url
GLSA-201612-44 vendor-advisory

Open in Interactive Console →