Vulnerability Database

296,147

Total vulnerabilities in the database

CVE-2017-8114

Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.

  • Published: Apr 29, 2017
  • Updated: Apr 13, 2023
  • CVE: CVE-2017-8114
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 8.8
  • AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: Medium
  • Score: 6.5
  • AV:N/AC:L/Au:S/C:P/I:P/A:P

CWEs:

Software From Fixed in
roundcube / webmail - 1.0.11
roundcube / webmail 1.1.0 1.1.9
roundcube / webmail 1.2.0 1.2.5