Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.
| Vendor | Product | Versions |
|---|---|---|
| roundcube | roundcube webmail | 1.6.0, 1.7.0, < 1.5.15, < 1.6.15, < 1.7-rc6, < 1.6.16, < 1.7.1, < 1.6.20, 1.7.0 - 1.7.4 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| open source | roundcube | cert_advisory | 90% |
Loading…
Severity updated from HIGH to CRITICAL based on new classification; CVSS estimate adjusted from 7.1 to 9.8 to reflect critical severity rating
Initial creation
