CVE-2014-9587: Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified…

PriorityP429medium6.8CVSS 2.0

AVNACMAuNCPIPAP

EPSS

2.14%

79.7th percentile

Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
debian	roundcube	< roundcube 1.1.1+dfsg.1-2 (bookworm)	roundcube 1.1.1+dfsg.1-2 (bookworm)
roundcube	webmail	<= 1.0.3	—

CVSS provenance

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

osv6.8MEDIUM

vendor_debian6.8MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.