CVE-2017-8114

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2017-8114
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8114.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-8114
Related
Published
2017-04-29T19:59:00Z
Modified
2024-09-18T02:51:39.539445Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.

References

Affected packages

Alpine:v3.2 / roundcubemail

Package

Name
roundcubemail
Purl
pkg:apk/alpine/roundcubemail?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.9-r0

Affected versions

0.*

0.2.1-r0
0.2.2-r0
0.3.1-r0
0.3.1-r1
0.4-r0
0.4-r1
0.4.2-r0
0.4.2-r1
0.5.1-r0
0.5.2-r0
0.5.2-r1
0.5.2-r2
0.5.3-r0
0.5.4-r0
0.6-r0
0.7-r0
0.7.1-r0
0.7.2-r0
0.8.0-r0
0.8.0-r1
0.8.1-r0
0.8.2-r0
0.8.3-r0
0.8.3-r1
0.8.4-r0
0.8.5-r0
0.8.6-r0
0.9.0-r0
0.9.1-r0
0.9.2-r0
0.9.3-r0
0.9.4-r0
0.9.5-r0

1.*

1.0.1-r0
1.0.2-r0
1.0.3-r0
1.0.4-r0
1.0.5-r0
1.1.0-r0
1.1.1-r0
1.1.2-r0
1.1.2-r1
1.1.2-r2
1.1.3-r0
1.1.4-r0
1.1.5-r0
1.1.6-r0
1.1.7-r0
1.1.8-r0

Alpine:v3.3 / roundcubemail

Package

Name
roundcubemail
Purl
pkg:apk/alpine/roundcubemail?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.9-r0

Affected versions

0.*

0.2.1-r0
0.2.2-r0
0.3.1-r0
0.3.1-r1
0.4-r0
0.4-r1
0.4.2-r0
0.4.2-r1
0.5.1-r0
0.5.2-r0
0.5.2-r1
0.5.2-r2
0.5.3-r0
0.5.4-r0
0.6-r0
0.7-r0
0.7.1-r0
0.7.2-r0
0.8.0-r0
0.8.0-r1
0.8.1-r0
0.8.2-r0
0.8.3-r0
0.8.3-r1
0.8.4-r0
0.8.5-r0
0.8.6-r0
0.9.0-r0
0.9.1-r0
0.9.2-r0
0.9.3-r0
0.9.4-r0
0.9.5-r0

1.*

1.0.1-r0
1.0.2-r0
1.0.3-r0
1.0.4-r0
1.0.5-r0
1.1.0-r0
1.1.1-r0
1.1.2-r0
1.1.2-r1
1.1.2-r2
1.1.3-r0
1.1.4-r0
1.1.5-r0
1.1.6-r0
1.1.7-r0
1.1.8-r0

Alpine:v3.4 / roundcubemail

Package

Name
roundcubemail
Purl
pkg:apk/alpine/roundcubemail?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.5-r0

Affected versions

0.*

0.2.1-r0
0.2.2-r0
0.3.1-r0
0.3.1-r1
0.4-r0
0.4-r1
0.4.2-r0
0.4.2-r1
0.5.1-r0
0.5.2-r0
0.5.2-r1
0.5.2-r2
0.5.3-r0
0.5.4-r0
0.6-r0
0.7-r0
0.7.1-r0
0.7.2-r0
0.8.0-r0
0.8.0-r1
0.8.1-r0
0.8.2-r0
0.8.3-r0
0.8.3-r1
0.8.4-r0
0.8.5-r0
0.8.6-r0
0.9.0-r0
0.9.1-r0
0.9.2-r0
0.9.3-r0
0.9.4-r0
0.9.5-r0

1.*

1.0.1-r0
1.0.2-r0
1.0.3-r0
1.0.4-r0
1.0.5-r0
1.1.0-r0
1.1.1-r0
1.1.2-r0
1.1.2-r1
1.1.2-r2
1.1.3-r0
1.1.4-r0
1.1.5-r0
1.1.5-r1
1.2.0-r0
1.2.0-r1
1.2.0-r2
1.2.2-r0
1.2.3-r0
1.2.4-r0

Alpine:v3.5 / roundcubemail

Package

Name
roundcubemail
Purl
pkg:apk/alpine/roundcubemail?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.5-r0

Affected versions

0.*

0.2.1-r0
0.2.2-r0
0.3.1-r0
0.3.1-r1
0.4-r0
0.4-r1
0.4.2-r0
0.4.2-r1
0.5.1-r0
0.5.2-r0
0.5.2-r1
0.5.2-r2
0.5.3-r0
0.5.4-r0
0.6-r0
0.7-r0
0.7.1-r0
0.7.2-r0
0.8.0-r0
0.8.0-r1
0.8.1-r0
0.8.2-r0
0.8.3-r0
0.8.3-r1
0.8.4-r0
0.8.5-r0
0.8.6-r0
0.9.0-r0
0.9.1-r0
0.9.2-r0
0.9.3-r0
0.9.4-r0
0.9.5-r0

1.*

1.0.1-r0
1.0.2-r0
1.0.3-r0
1.0.4-r0
1.0.5-r0
1.1.0-r0
1.1.1-r0
1.1.2-r0
1.1.2-r1
1.1.2-r2
1.1.3-r0
1.1.4-r0
1.1.5-r0
1.1.5-r1
1.2.0-r0
1.2.0-r1
1.2.0-r2
1.2.1-r0
1.2.2-r0
1.2.3-r0
1.2.4-r0

Debian:11 / roundcube

Package

Name
roundcube
Purl
pkg:deb/debian/roundcube?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.3+dfsg.1-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / roundcube

Package

Name
roundcube
Purl
pkg:deb/debian/roundcube?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.3+dfsg.1-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / roundcube

Package

Name
roundcube
Purl
pkg:deb/debian/roundcube?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.3+dfsg.1-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/roundcube/roundcubemail

Affected ranges

Type
GIT
Repo
https://github.com/roundcube/roundcubemail
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ca74231733849fb170a272cf5bf67e230cee3745

Affected versions

1.*

1.0.0
1.0.1
1.0.10
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9

v0.*

v0.1-beta2

v1.*

v1.0-beta
v1.0-rc