CVE-2017-8114

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Apr 29, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-81155.3Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow rem CVE-2017-81169.8The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute CVE-2017-81179.8The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper proce CVE-2017-81182.3The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some sen CVE-2017-81199.8The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper proce CVE-2017-81209.8The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper proce CVE-2017-81215.3The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some sen CVE-2017-81229.8The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of para CVE-2017-81239.8The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of para CVE-2017-81249.8The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of para CVE-2017-81256.1The UMA product with software V200R001 and V300R001 has a cross-site scripting (XSS) vulnerability due to insufficient input validation. An CVE-2017-81269.8The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of para