Description
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
Metrics
CVSS 3.1 8.8/10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://www.securityfocus.com/bid/98445Third Party Advisory, VDB Entry
- https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114Exploit, Third Party Advisory
- https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11Release Notes, Vendor Advisory
- https://security.gentoo.org/glsa/201707-11Third Party Advisory
- http://www.securityfocus.com/bid/98445Third Party Advisory, VDB Entry
- https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114Exploit, Third Party Advisory
- https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11Release Notes, Vendor Advisory
- https://security.gentoo.org/glsa/201707-11Third Party Advisory
Timeline
- Published
- Apr 29, 2017
- Last modified
- Jun 17, 2026
- NVD status
- Modified