CVE-2014-9587

Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://roundcube.net/news/2014/12/18/update-1.0.4-released/	Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2015/01/11/3
http://www.securityfocus.com/bid/71909
https://bugs.gentoo.org/show_bug.cgi?id=534766
https://bugzilla.redhat.com/show_bug.cgi?id=1179780

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*

Information

Published : 2015-01-15 07:59

Updated : 2015-01-16 09:19

NVD link : CVE-2014-9587

Mitre link : CVE-2014-9587

JSON object : View

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

Advertisement

Products Affected

roundcube

webmail

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://roundcube.net/news/2014/12/18/update-1.0.4-released/", "name": "http://roundcube.net/news/2014/12/18/update-1.0.4-released/", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.openwall.com/lists/oss-security/2015/01/11/3", "name": "[oss-security] 20150111 Re: CVE request: roundcubemail: possible CSRF attacks to some address book operations as well as to the ACL and Managesieve plugins", "tags": [], "refsource": "MLIST"}, {"url": "http://www.securityfocus.com/bid/71909", "name": "71909", "tags": [], "refsource": "BID"}, {"url": "https://bugs.gentoo.org/show_bug.cgi?id=534766", "name": "https://bugs.gentoo.org/show_bug.cgi?id=534766", "tags": [], "refsource": "MISC"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1179780", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1179780", "tags": [], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-352"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-9587", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2015-01-15T15:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.0.3"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2015-01-16T17:19Z"}