CVE-2017-8114 PUBLISHED

Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.

EPSS 0.63% · 70.2th percentile

Risk Scores

EPSS Score
0.63%
70.2th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:16.04:LTSroundcube0, 1.1.1+dfsg.1-2, 1.1.2+dfsg.1-5

Timeline

References

Open in Interactive Console →