CVE-2018-9846
CVE-2018-9846
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.
CVSS 8.8 · High · EPSS 2.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
roundcube Debian:12
- Affected ranges
- ECOSYSTEM: < 1.3.6+dfsg.1-1
Update to 1.3.6+dfsg.1-1
roundcube Debian:13
- Affected ranges
- ECOSYSTEM: < 1.3.6+dfsg.1-1
Update to 1.3.6+dfsg.1-1
roundcube Debian:14
- Affected ranges
- ECOSYSTEM: < 1.3.6+dfsg.1-1
Update to 1.3.6+dfsg.1-1
roundcube Ubuntu:Pro:16.04:LTS
- Versions
- 1.1.1+dfsg.1-2
- 1.1.2+dfsg.1-5
- 1.1.3+dfsg.1-1
- 1.1.4+dfsg.1-1
- 1.2~beta+dfsg.1-0ubuntu1
- 1.2~beta+dfsg.1-0ubuntu1+esm1
- 1.2~beta+dfsg.1-0ubuntu1+esm2
- 1.2~beta+dfsg.1-0ubuntu1+esm3
- 1.2~beta+dfsg.1-0ubuntu1+esm4
- 1.2~beta+dfsg.1-0ubuntu1+esm5
- 1.2~beta+dfsg.1-0ubuntu1+esm6
- Affected ranges
- ECOSYSTEM: < 1.2~beta+dfsg.1-0ubuntu1+esm7
Update to 1.2~beta+dfsg.1-0ubuntu1+esm7