CVE-2020-12641: roundcube webmail +2 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2020-12641

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 84,5%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada roundcube webmail, opensuse backports sle +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 22 Juni 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

Rincian

Terbit di NVD: 4 Mei 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
EPSS (30 hari): 84,5% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Roundcube Webmail Remote Code Execution Vulnerability
Masuk KEV: 22 Juni 2023
Tenggat CISA: 13 Juli 2023 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
roundcube	webmail	Versi 1.2.0 hingga sebelum 1.2.10
roundcube	webmail	Versi 1.3.0 hingga sebelum 1.3.11
roundcube	webmail	Versi 1.4.0 hingga sebelum 1.4.4
opensuse	backports sle	Versi 15.0 sp1
opensuse	backports sle	Versi 15.0 sp2
opensuse	leap	Versi 15.1
opensuse	leap	Versi 15.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10 release notes · advisory vendor
https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3 patch
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-12641 pemerintah AS
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html mailing list · advisory pihak ketiga
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube exploit · advisory pihak ketiga
https://security.gentoo.org/glsa/202007-41 advisory pihak ketiga
https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4 release notes
https://github.com/roundcube/roundcubemail/releases/tag/1.4.4 release notes

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.