peter bassill · operator
$ cve CVE-2017-16651 JSON

CVE-2017-16651 KEV

7.8
HIGH · CVSS 3.1 · EPSS 45.7% (pctl 99)

Patch first

On CISA KEV — known exploited in the wild, due 2022-05-03.

Description

Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.

Scoring

CVSS7.8 (HIGH, v3.1)
VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS45.74% — more likely to be exploited than 99% of all CVEs
WeaknessCWE-552
On CISA KEVyes — remediate by 2022-05-03
Public exploitnone known
Published2017-11-09
Last modified2026-06-17

CISA KEV

NameRoundcube Webmail File Disclosure Vulnerability
Added2021-11-03
Due2022-05-03
Vendor / productRoundcube / Roundcube Webmail
Ransomware usenone reported

Affected (2)

VendorProduct
debiandebian linux
roundcubewebmail

References

→ the Explorer  ·  watch your stack  ·  NVD