⚠ Actively exploited
Added to CISA KEV on 2021-11-03. Federal agencies required to patch by 2022-05-03. Required action: Apply updates per vendor instructions..

CVE-2017-16651Files or Directories Accessible to External Parties in Webmail

Severity
7.8HIGHNVD
EPSS
33.3%
top 3.08%
CISA KEV
KEV
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedNov 9
KEV addedNov 3
KEV dueMay 3
Latest updateJan 13
CISA Required Action: Apply updates per vendor instructions.

Description

Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages1 packages

NVDroundcube/webmail1.1.9+10

Also affects: Debian Linux 7.0, 9.0

Patches

🔴Vulnerability Details

4
GHSA
GHSA-6r67-r3jm-88p4: Roundcube Webmail before 12022-05-13
OSV
CVE-2017-16651: Roundcube Webmail before 12017-11-09
CVEList
CVE-2017-16651: Roundcube Webmail before 12017-11-09
VulnCheck
Roundcube Webmail File Disclosure Vulnerability2017

💥Exploits & PoCs

2
Exploit-DB
Roundcube Webmail 1.2 - File Disclosure2021-02-01
Metasploit
Roundcube TimeZone Authenticated File Disclosure

📋Vendor Advisories

3
Ubuntu
Roundcube vulnerability2025-01-13
CISA
Roundcube Webmail File Disclosure Vulnerability2021-11-03
Debian
CVE-2017-16651: roundcube - Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allo...2017

💬Community

1
Bugzilla
CVE-2017-16651 roundcubemail: Unauthorized access to arbitrary files2017-11-10
CVE-2017-16651 — Roundcube Webmail vulnerability | cvebase