CVE-2017-16651

2017-11-0914:29:00

Alpine Linux Development Team

security.alpinelinux.org

0.015 Low

EPSS

Percentile

86.8%

JSON

Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host’s filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.

OSVersionArchitecturePackageVersionFilename
Alpine3.10-communitynoarchroundcubemail< 1.2.7-r0UNKNOWN
Alpine3.3-mainnoarchroundcubemail< 1.1.10-r0UNKNOWN
Alpine3.4-mainnoarchroundcubemail< 1.2.7-r0UNKNOWN
Alpine3.5-mainnoarchroundcubemail< 1.2.7-r0UNKNOWN
Alpine3.6-communitynoarchroundcubemail< 1.2.7-r0UNKNOWN
Alpine3.7-communitynoarchroundcubemail< 1.2.7-r0UNKNOWN
Alpine3.8-communitynoarchroundcubemail< 1.2.7-r0UNKNOWN
Alpine3.9-communitynoarchroundcubemail< 1.2.7-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	3.10-community	noarch	roundcubemail	< 1.2.7-r0	UNKNOWN
Alpine	3.3-main	noarch	roundcubemail	< 1.1.10-r0	UNKNOWN
Alpine	3.4-main	noarch	roundcubemail	< 1.2.7-r0	UNKNOWN
Alpine	3.5-main	noarch	roundcubemail	< 1.2.7-r0	UNKNOWN
Alpine	3.6-community	noarch	roundcubemail	< 1.2.7-r0	UNKNOWN
Alpine	3.7-community	noarch	roundcubemail	< 1.2.7-r0	UNKNOWN
Alpine	3.8-community	noarch	roundcubemail	< 1.2.7-r0	UNKNOWN
Alpine	3.9-community	noarch	roundcubemail	< 1.2.7-r0	UNKNOWN