AEGLIX vulnerability intelligence
CVE-2017-16651
HIGH · CVSS 7.8 · Analyzed
Published: 2017-11-09 · Updated: 2026-06-17 · Source: NVD
Vulnerability overview
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
Severity and scoring
- CVSS score
- 7.8 · HIGH
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-552
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected product
- Roundcube · Roundcube Webmail
- Added to catalog
- 2021-11-03
- Required action
- Apply updates per vendor instructions.
- CISA remediation due date
- 2022-05-03
CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
Through (inclusive): 1.1.9
cpe:2.3:a:roundcube:webmail:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:1.2.3:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:1.2.4:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:1.2.5:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:1.2.6:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:roundcube:webmail:1.3.2:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html
Exploit · Third Party Advisory · VDB Entry
- http://www.securityfocus.com/bid/101793
Third Party Advisory · VDB Entry
- https://github.com/roundcube/roundcubemail/issues/6026
Issue Tracking · Patch · Third Party Advisory
- https://github.com/roundcube/roundcubemail/releases/tag/1.1.10
Issue Tracking · Release Notes · Third Party Advisory
- https://github.com/roundcube/roundcubemail/releases/tag/1.2.7
Issue Tracking · Release Notes · Third Party Advisory
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.3
Issue Tracking · Release Notes · Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html
Mailing List · Third Party Advisory
- https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10
Issue Tracking · Vendor Advisory
- https://www.debian.org/security/2017/dsa-4030
Issue Tracking · Third Party Advisory
- http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html
Exploit · Third Party Advisory · VDB Entry
- http://www.securityfocus.com/bid/101793
Third Party Advisory · VDB Entry
- https://github.com/roundcube/roundcubemail/issues/6026
Issue Tracking · Patch · Third Party Advisory
- https://github.com/roundcube/roundcubemail/releases/tag/1.1.10
Issue Tracking · Release Notes · Third Party Advisory
- https://github.com/roundcube/roundcubemail/releases/tag/1.2.7
Issue Tracking · Release Notes · Third Party Advisory
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.3
Issue Tracking · Release Notes · Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html
Mailing List · Third Party Advisory
- https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10
Issue Tracking · Vendor Advisory
- https://www.debian.org/security/2017/dsa-4030
Issue Tracking · Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-16651
US Government Resource