CVE-2011-4078 — Webmail vulnerability
11 documents6 sources
Severity
5.0MEDIUMNVD
CNA7.5OSV7.5
EPSS
0.9%
top 24.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 3
Latest updateMay 17
Description
include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service (resource consumption and inbox outage), via a Subject header containing only a URL, a related issue to CVE-2011-3379.
CVSS vector
AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9
Affected Packages1 packages
Patches
🔴Vulnerability Details
3📋Vendor Advisories
1Debian▶
CVE-2011-4078: roundcube - include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3...↗2011
💬Community
6Bugzilla▶
CVE-2010-4078 php-pear-MDB2, roundcubemail: DoS (unavailability to access user's INBOX) after receiving an email message with the URL in the Subject [epel-6]↗2011-10-26
Bugzilla▶
CVE-2011-4078 php-pear-MDB2, roundcubemail: DoS (unavailability to access user's INBOX) after receiving an email message with the URL in the Subject [fedora-15]↗2011-10-26
Bugzilla▶
CVE-2011-4078 php-pear-MDB2, roundcubemail: DoS (unavailability to access user's INBOX) after receiving an email message with the URL in the Subject↗2011-10-26
Bugzilla▶
CVE-2011-4078 php-pear-MDB2, roundcubemail: DoS (unavailability to access user's INBOX) after receiving an email message with the URL in the Subject [fedora-all]↗2011-10-26
Bugzilla▶
CVE-2011-4078 php-pear-MDB2, roundcubemail: DoS (unavailability to access user's INBOX) after receiving an email message with the URL in the Subject [epel-6]↗2011-10-26