CVE-2017-16651

Katalog CVE

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 45,7%

Kerentanan Files or Directories Accessible to External Parties pada roundcube webmail, debian linux. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.

Rincian

Terbit di NVD

9 November 2017

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

45,7% peluang dieksploitasi; lebih tinggi dari 98,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Roundcube Webmail File Disclosure Vulnerability

Masuk KEV

3 November 2021

Tenggat CISA

3 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10 issue tracking · advisory vendor
• https://github.com/roundcube/roundcubemail/issues/6026 issue tracking · patch · advisory pihak ketiga
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-16651 pemerintah AS
• http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html exploit · advisory pihak ketiga · vdb entry
• http://www.securityfocus.com/bid/101793 advisory pihak ketiga · vdb entry
• https://github.com/roundcube/roundcubemail/releases/tag/1.1.10 issue tracking · release notes · advisory pihak ketiga
• https://github.com/roundcube/roundcubemail/releases/tag/1.2.7 issue tracking · release notes · advisory pihak ketiga
• https://github.com/roundcube/roundcubemail/releases/tag/1.3.3 issue tracking · release notes · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html mailing list · advisory pihak ketiga
• https://www.debian.org/security/2017/dsa-4030 issue tracking · advisory pihak ketiga