CVE-2020-12640 PUBLISHED

Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.

EPSS 22.66% · 95.8th percentile

Risk Scores

EPSS Score
22.66%
95.8th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:18.04:LTSroundcube0, 1.3.0+dfsg.1-1, 1.3.1+dfsg.1-1
Ubuntu:Pro:16.04:LTSroundcube0, 1.1.1+dfsg.1-2, 1.1.2+dfsg.1-5
Ubuntu:Pro:20.04:LTSroundcube0, 1.3.8+dfsg.1-2, 1.3.10+dfsg.1-1

Timeline

References

Open in Interactive Console →