CVE-2017-8114

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2017-8114
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8114.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-8114
Related
Published
2017-04-29T19:59:00Z
Modified
2024-05-30T01:31:19.606421Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.

References

Affected packages

Alpine:v3.2 / roundcubemail

Package

Name
roundcubemail
Purl
pkg:apk/alpine/roundcubemail?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.9-r0

Affected versions

0.*

0.2.1-r0
0.2.2-r0
0.3.1-r0
0.3.1-r1
0.4-r0
0.4-r1
0.4.2-r0
0.4.2-r1
0.5.1-r0
0.5.2-r0
0.5.2-r1
0.5.2-r2
0.5.3-r0
0.5.4-r0
0.6-r0
0.7-r0
0.7.1-r0
0.7.2-r0
0.8.0-r0
0.8.0-r1
0.8.1-r0
0.8.2-r0
0.8.3-r0
0.8.3-r1
0.8.4-r0
0.8.5-r0
0.8.6-r0
0.9.0-r0
0.9.1-r0
0.9.2-r0
0.9.3-r0
0.9.4-r0
0.9.5-r0

1.*

1.0.1-r0
1.0.2-r0
1.0.3-r0
1.0.4-r0
1.0.5-r0
1.1.0-r0
1.1.1-r0
1.1.2-r0
1.1.2-r1
1.1.2-r2
1.1.3-r2
1.1.4-r2
1.1.5-r2
1.1.6-r2
1.1.7-r2
1.1.8-r2

Alpine:v3.3 / roundcubemail

Package

Name
roundcubemail
Purl
pkg:apk/alpine/roundcubemail?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.9-r0

Affected versions

0.*

0.2.1-r0
0.2.2-r0
0.3.1-r0
0.3.1-r1
0.4-r0
0.4-r1
0.4.2-r0
0.4.2-r1
0.5.1-r0
0.5.2-r0
0.5.2-r1
0.5.2-r2
0.5.3-r0
0.5.4-r0
0.6-r0
0.7-r0
0.7.1-r0
0.7.2-r0
0.8.0-r0
0.8.0-r1
0.8.1-r0
0.8.2-r0
0.8.3-r0
0.8.3-r1
0.8.4-r0
0.8.5-r0
0.8.6-r0
0.9.0-r0
0.9.1-r0
0.9.2-r0
0.9.3-r0
0.9.4-r0
0.9.5-r0

1.*

1.0.1-r0
1.0.2-r0
1.0.3-r0
1.0.4-r0
1.0.5-r0
1.1.0-r0
1.1.1-r0
1.1.2-r0
1.1.2-r1
1.1.2-r2
1.1.3-r2
1.1.4-r2
1.1.5-r2
1.1.6-r2
1.1.7-r2
1.1.8-r2

Alpine:v3.4 / roundcubemail

Package

Name
roundcubemail
Purl
pkg:apk/alpine/roundcubemail?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.5-r0

Affected versions

0.*

0.2.1-r0
0.2.2-r0
0.3.1-r0
0.3.1-r1
0.4-r0
0.4-r1
0.4.2-r0
0.4.2-r1
0.5.1-r0
0.5.2-r0
0.5.2-r1
0.5.2-r2
0.5.3-r0
0.5.4-r0
0.6-r0
0.7-r0
0.7.1-r0
0.7.2-r0
0.8.0-r0
0.8.0-r1
0.8.1-r0
0.8.2-r0
0.8.3-r0
0.8.3-r1
0.8.4-r0
0.8.5-r0
0.8.6-r0
0.9.0-r0
0.9.1-r0
0.9.2-r0
0.9.3-r0
0.9.4-r0
0.9.5-r0

1.*

1.0.1-r0
1.0.2-r0
1.0.3-r0
1.0.4-r0
1.0.5-r0
1.1.0-r0
1.1.1-r0
1.1.2-r0
1.1.2-r1
1.1.2-r2
1.1.3-r0
1.1.4-r0
1.1.5-r0
1.1.5-r1
1.2.0-r0
1.2.0-r1
1.2.0-r2
1.2.2-r2
1.2.3-r2
1.2.4-r2

Alpine:v3.5 / roundcubemail

Package

Name
roundcubemail
Purl
pkg:apk/alpine/roundcubemail?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.5-r0

Affected versions

0.*

0.2.1-r0
0.2.2-r0
0.3.1-r0
0.3.1-r1
0.4-r0
0.4-r1
0.4.2-r0
0.4.2-r1
0.5.1-r0
0.5.2-r0
0.5.2-r1
0.5.2-r2
0.5.3-r0
0.5.4-r0
0.6-r0
0.7-r0
0.7.1-r0
0.7.2-r0
0.8.0-r0
0.8.0-r1
0.8.1-r0
0.8.2-r0
0.8.3-r0
0.8.3-r1
0.8.4-r0
0.8.5-r0
0.8.6-r0
0.9.0-r0
0.9.1-r0
0.9.2-r0
0.9.3-r0
0.9.4-r0
0.9.5-r0

1.*

1.0.1-r0
1.0.2-r0
1.0.3-r0
1.0.4-r0
1.0.5-r0
1.1.0-r0
1.1.1-r0
1.1.2-r0
1.1.2-r1
1.1.2-r2
1.1.3-r0
1.1.4-r0
1.1.5-r0
1.1.5-r1
1.2.0-r0
1.2.0-r1
1.2.0-r2
1.2.1-r0
1.2.2-r0
1.2.3-r0
1.2.4-r0

Git / github.com/roundcube/roundcubemail

Affected ranges

Type
GIT
Repo
https://github.com/roundcube/roundcubemail
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

1.*

1.0.0
1.0.1
1.0.10
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9

v0.*

v0.1-beta2

v1.*

v1.0-beta
v1.0-rc