| Vulnerability Name: | CVE-2016-9920 (CCN-119647) | ||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2016-12-06 | ||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2016-12-06 | ||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2017-07-01 | ||||||||||||||||||||||||||||||||||||||||||||
| Summary: | steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message. | ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) 6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
6.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 6.0 Medium (CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P)
| ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-284 | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2016-9920 Source: CCN Type: Full-Disclosure Mailing List, Tue, 6 Dec 2016 19:56:02 +0100 Roundcube 1.2.2: Command Execution via Email Source: MLIST Type: Mailing List, Third Party Advisory [oss-security] 20161208 roundcube code execution via mail() Source: BID Type: UNKNOWN 94858 Source: CCN Type: BID-94858 Roundcube CVE-2016-9920 Remote Code Execution Vulnerability Source: MISC Type: Exploit, Third Party Advisory https://blog.ripstech.com/2016/roundcube-command-execution-via-email/ Source: XF Type: UNKNOWN roundcube-webmail-cmd-exec(119647) Source: CCN Type: Packet Storm Security [12-09-2016] Roundcube 1.2.2 Command Execution Source: CCN Type: Roundcube Web Site Roundcube Webmail Source: CONFIRM Type: Release Notes, Vendor Advisory https://roundcube.net/news/2016/11/28/updates-1.2.3-and-1.1.7-released Source: GENTOO Type: UNKNOWN GLSA-201612-44 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [12-09-2016] | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||