CVE-2017-8114

Roundcube Webmail allows arbitrary password resets by authenticated users

published April 29, 2017

CVSS
—
EPSS
3%
Percentile
88.9
In the wild
Unconfirmed
What it is

Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03471 · 88.9th percentile
Published
2017-04-29T19:00Z
EPSS history
Timeline
  • 29 APR 19:00Z
    Roundcube Webmail allows arbitrary password resets by authenticated users
    cvelistv5