CVE-2015-5382 — Sensitive Information Exposure in Webmail

CWE-200 — Sensitive Information Exposure9 documents7 sources
Severity
6.5MEDIUMNVD
EPSS
1.0%
top 22.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Roundcube WebmailRoundcube Webmail
Timeline
PublishedMay 23
Latest updateMay 14

Description

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶Debianroundcube/roundcube_webmail< 1.1.2+dfsg.1-1+3

Patches

Patch: www.openwall.com ↗Patch: www.openwall.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-w7xj-f8mh-628v: program/steps/addressbook/photo↗2022-05-14
▶
CVEList
CVE-2015-5382: program/steps/addressbook/photo↗2017-05-23
▶
OSV
CVE-2015-5382: program/steps/addressbook/photo↗2017-05-23
▶

💥Exploits & PoCs

1
Exploit-DB
Nvidia Stereoscopic 3D Driver Service 7.17.13.5382 - Arbitrary Run Key Creation↗2015-11-23
▶

📋Vendor Advisories

1
Debian
CVE-2015-5382: roundcube - program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x ...↗2015
▶

💬Community

3
Bugzilla
CVE-2015-5383 CVE-2015-5382 CVE-2015-5381 roundcubemail: vulnerabilities fixed in 1.1.2 and 1.0.6 [epel-all]↗2015-07-08
▶
Bugzilla
CVE-2015-5383 CVE-2015-5382 CVE-2015-5381 roundcubemail: vulnerabilities fixed in 1.1.2 and 1.0.6 [fedora-all]↗2015-07-08
▶
Bugzilla
CVE-2015-5381 CVE-2015-5382 CVE-2015-5383 roundcubemail: vulnerabilities fixed in 1.1.2 and 1.0.6↗2015-07-08
▶
CVE-2015-5382 — Sensitive Information Exposure | cvebase