Vulnerability Name:

CVE-2020-12640 (CCN-181373)

Assigned:2020-04-26
Published:2020-04-26
Updated:2022-09-02
Summary:Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.
CVSS v3 Severity:9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-22
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2020-12640

Source: SUSE
Type: Third Party Advisory
openSUSE-SU-2020:1516

Source: XF
Type: UNKNOWN
roundcube-cve202012640-file-include(181373)

Source: MISC
Type: Exploit, Third Party Advisory
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube

Source: CCN
Type: Roundcube Webmail GIT Repository
Fix local file inclusion (and code execution) via crafted 'plugins'

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/roundcube/roundcubemail/commit/814eadb699e8576ce3a78f21e95bf69a7c7b3794

Source: MISC
Type: Release Notes, Third Party Advisory
https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4

Source: MISC
Type: Release Notes, Third Party Advisory
https://github.com/roundcube/roundcubemail/releases/tag/1.4.4

Source: MISC
Type: Release Notes, Vendor Advisory
https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10

Source: GENTOO
Type: Third Party Advisory
GLSA-202007-41

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2020-12640

Vulnerable Configuration:Configuration 1:
  • cpe:/a:roundcube:webmail:*:*:*:*:*:*:*:* (Version >= 1.3.0 and < 1.3.11)
  • OR cpe:/a:roundcube:webmail:*:*:*:*:*:*:*:* (Version >= 1.4.0 and < 1.4.4)
  • OR cpe:/a:roundcube:webmail:*:*:*:*:*:*:*:* (Version >= 1.2.0 and < 1.2.10)

    • Configuration 2:
  • cpe:/o:opensuse:leap:15.1:*:*:*:*:*:*:*
  • OR cpe:/a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*
  • OR cpe:/o:opensuse:leap:15.2:*:*:*:*:*:*:*
  • OR cpe:/a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:roundcube:webmail:1.4.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:202012640
    V
    		CVE-2020-12640
    2022-05-22
    oval:org.opensuse.security:def:64835
    P
    		Security update for systemd (Moderate)
    2022-01-11
    oval:org.opensuse.security:def:64625
    P
    		Security update for xen (Moderate)
    2021-12-03
    oval:org.opensuse.security:def:64626
    P
    		Security update for aaa_base (Moderate)
    2021-12-03
    oval:org.opensuse.security:def:64893
    P
    		Security update for containerd, docker, runc (Important)
    2021-10-25
    oval:org.opensuse.security:def:63484
    P
    		libgstaudio-1_0-0-32bit-1.16.2-2.12 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63346
    P
    		librelp-devel-1.2.15-1.15 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:64733
    P
    		Security update for the Linux Kernel (Important)
    2021-07-20
    oval:org.opensuse.security:def:64533
    P
    		Security update for salt (Critical)
    2021-06-21
    oval:org.opensuse.security:def:62865
    P
    		ocaml-libguestfs-devel-1.38.0-3.52 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:64489
    P
    		Security update for p7zip (Moderate)
    2021-05-04
    oval:org.opensuse.security:def:63078
    P
    		reiserfs-kmp-default-4.12.14-195.1 on GA media (Moderate)
    2021-04-29
    oval:org.opensuse.security:def:64277
    P
    		Security update for gcc7 (Moderate)
    2020-12-10
    oval:org.opensuse.security:def:63110
    P
    		rmt-server-pubcloud-1.2.2-1.15 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63581
    P
    		imobiledevice-tools-1.2.0+git20170122.45fda81-1.44 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62665
    P
    		libdjvulibre-devel-3.5.27-9.28 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62664
    P
    		libcolord-gtk-devel-0.1.26-1.48 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63085
    P
    		ntp-4.2.8p13-4.6.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63288
    P
    		nginx-1.16.1-1.21 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62688
    P
    		libopenjpeg1-1.5.2-2.28 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63144
    P
    		bind-9.11.2-10.4 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63082
    P
    		libcgroup-devel-0.41.rc1-1.10.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:74947
    P
    		Security update for tigervnc (Important)
    2020-12-01
    oval:org.opensuse.security:def:64379
    P
    		librsync-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64037
    P
    		Security update for git (Important)
    2020-12-01
    oval:org.opensuse.security:def:63931
    P
    		Security update for mailman (Important)
    2020-12-01
    oval:org.opensuse.security:def:74599
    P
    		Security update for roundcubemail (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:65005
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:63710
    P
    		Security update for openssh (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:75080
    P
    		Security update for roundcubemail (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64421
    P
    		openslp on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64171
    P
    		Security update for u-boot (Important)
    2020-12-01
    oval:org.opensuse.security:def:63784
    P
    		Security update for nmap (Important)
    2020-12-01
    oval:org.opensuse.security:def:74473
    P
    		Security update for phpMyAdmin (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64160
    P
    		Security update for bcm43xx-firmware (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:100237
    P
    		 (Moderate)
    2020-10-28
    oval:org.opensuse.security:def:96367
    P
    		Security update for roundcubemail (Moderate)
    2020-09-24
    oval:org.opensuse.security:def:110775
    P
    		Security update for roundcubemail (Moderate)
    2020-09-24
    oval:org.opensuse.security:def:109714
    P
    		Security update for roundcubemail (Moderate)
    2020-09-24
    oval:org.opensuse.security:def:103057
    P
    		Security update for roundcubemail (Moderate)
    2020-09-24
    oval:org.opensuse.security:def:93524
    P
    		Security update for roundcubemail (Moderate)
    2020-09-24
    oval:org.opensuse.security:def:110223
    P
    		Security update for roundcubemail (Moderate)
    2020-09-24
    BACK
    roundcube webmail *
    roundcube webmail *
    roundcube webmail *
    opensuse leap 15.1
    opensuse backports sle 15.0 sp1
    opensuse leap 15.2
    opensuse backports sle 15.0 sp2
    roundcube webmail 1.4.3