CVE-2017-8114
CVE-2017-8114
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
CVSS 8.8 · High · EPSS 3.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
roundcube Debian:12
- Affected ranges
- ECOSYSTEM: < 1.2.3+dfsg.1-4
Update to 1.2.3+dfsg.1-4
roundcube Debian:13
- Affected ranges
- ECOSYSTEM: < 1.2.3+dfsg.1-4
Update to 1.2.3+dfsg.1-4
roundcube Debian:14
- Affected ranges
- ECOSYSTEM: < 1.2.3+dfsg.1-4
Update to 1.2.3+dfsg.1-4
roundcube Ubuntu:Pro:16.04:LTS
- Versions
- 1.1.1+dfsg.1-2
- 1.1.2+dfsg.1-5
- 1.1.3+dfsg.1-1
- 1.1.4+dfsg.1-1
- 1.2~beta+dfsg.1-0ubuntu1
- 1.2~beta+dfsg.1-0ubuntu1+esm1
- 1.2~beta+dfsg.1-0ubuntu1+esm2
- 1.2~beta+dfsg.1-0ubuntu1+esm3
- 1.2~beta+dfsg.1-0ubuntu1+esm4
- 1.2~beta+dfsg.1-0ubuntu1+esm5
- 1.2~beta+dfsg.1-0ubuntu1+esm6
- Affected ranges
- ECOSYSTEM: < 1.2~beta+dfsg.1-0ubuntu1+esm7
Update to 1.2~beta+dfsg.1-0ubuntu1+esm7