CVE-2015-5383

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/07/07/2Mailing List, Patch, Third Party Advisory
https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39Issue Tracking, Patch, Third Party Advisory
https://github.com/roundcube/roundcubemail/issues/4816Issue Tracking, Patch, Third Party Advisory
https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-releasedPatch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2015/07/07/2Mailing List, Patch, Third Party Advisory
https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39Issue Tracking, Patch, Third Party Advisory
https://github.com/roundcube/roundcubemail/issues/4816Issue Tracking, Patch, Third Party Advisory
https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-releasedPatch, Vendor Advisory

Timeline

Published: May 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-53848.8AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier is vulnerable to a Session Fixation attack.CVE-2015-53869.3Siemens SICAM MIC devices with firmware before 2404 allow remote attackers to bypass authentication and obtain administrative access via uns CVE-2015-53958.8Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0.CVE-2015-53976.8Cross-site request forgery (CSRF) vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.2 allows remote attackers to hijack the CVE-2015-53995.4Cross-site scripting (XSS) vulnerability in PHPVibe before 4.21 allows remote authenticated users to inject arbitrary web script or HTML via CVE-2015-54006.8Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to CVE-2015-54017.5Teradata Gateway before 15.00.03.02-1 and 15.10.x before 15.10.00.01-1 and TD Express before 15.00.02.08_Sles10 and 15.00.02.08_Sles11 allow CVE-2015-54027.2HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows local user CVE-2015-54034.0HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote aut CVE-2015-54047.5HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote att CVE-2015-54056.5HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote aut CVE-2015-54069.0HP CentralView Fraud Risk Management 11.1, 11.2, and 11.3; CentralView Revenue Leakage Control 4.1, 4.2, and 4.3; CentralView Dealer Perform