SB2017042801 - Security restrictions bypass in Roundcube
Published: April 28, 2017 Updated: July 12, 2017
Security Bulletin ID
SB2017042801
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Security restrictions bypass (CVE-ID: CVE-2017-8114)
The vulnerability allows a remote authenticated attacker to bypass security restrictions.The weakness exists due to improper restriction of exec call in the virtualmin and sasl drivers of the password plugin. A remote attcker can arbitrarily reset passwords, bypass security restrictions and gain elevated privileges on the system.
Successful exploitation of the vulnerability results in privilege escalation.
Remediation
Install update from vendor's website.