{"id":"CVE-2017-16651","aliases":["ALPINE-CVE-2017-16651","DEBIAN-CVE-2017-16651","DLA-1193-1","DSA-4030-1","EUVD-2017-7838","GHSA-6r67-r3jm-88p4","MGASA-2017-0409","UBUNTU-CVE-2017-16651","USN-7200-1","openSUSE-SU-2024:11303-1"],"status":"published","title":"Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized...","description":"Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings\u0026_action=upload-display\u0026_from=timezone requests.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.45742,"percentile":0.98805,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-552"],"published":"2017-11-09T00:00:00Z","modified":"2026-10-20T10:48:16Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"pocgithub","id":"ropbear/CVE-2017-16651","title":"ropbear/CVE-2017-16651","date":"2021-01-06","url":"https://github.com/ropbear/CVE-2017-16651"},{"source":"metasploit","id":"auxiliary/gather/roundcube_auth_file_read","title":"Roundcube TimeZone Authenticated File Disclosure","type":"auxiliary","date":"2017-11-09","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/gather/roundcube_auth_file_read"}],"fixes":[{"ecosystem":"Alpine:v3.3","package":"roundcubemail","fixed_in":["1.1.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"roundcubemail","fixed_in":["1.2.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"roundcubemail","fixed_in":["1.2.7-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"roundcube","fixed_in":["1.3.3+dfsg.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"roundcube","fixed_in":["1.3.3+dfsg.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"roundcube","fixed_in":["1.3.3+dfsg.1-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"roundcube","fixed_in":["0.7.2-9+deb7u9"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"roundcube","fixed_in":["1.2.3+dfsg.1-4+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"roundcubemail","fixed_in":["1.0.11-1.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"roundcubemail","fixed_in":["1.2.5-1.1.mga6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"roundcube","fixed_in":["1.2~beta+dfsg.1-0ubuntu1+esm5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.3","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3+dfsg.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3+dfsg.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3+dfsg.1-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2-9+deb7u9"}]}],"versions":["0.7.2-9","0.7.2-9+deb7u1","0.7.2-9+deb7u2","0.7.2-9+deb7u3","0.7.2-9+deb7u4","0.7.2-9+deb7u5","0.7.2-9+deb7u6","0.7.2-9+deb7u7","0.7.2-9+deb7u8"]},{"source":"osv","ecosystem":"Debian:9","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3+dfsg.1-4+deb9u1"}]}],"versions":["1.2.3+dfsg.1-4"]},{"source":"osv","ecosystem":"Mageia:5","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.11-1.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-1.1.mga6"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2~beta+dfsg.1-0ubuntu1+esm5"}]}],"versions":["1.1.1+dfsg.1-2","1.1.2+dfsg.1-5","1.1.3+dfsg.1-1","1.1.4+dfsg.1-1","1.2~beta+dfsg.1-0ubuntu1","1.2~beta+dfsg.1-0ubuntu1+esm1","1.2~beta+dfsg.1-0ubuntu1+esm2","1.2~beta+dfsg.1-0ubuntu1+esm3","1.2~beta+dfsg.1-0ubuntu1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2~beta+dfsg.1-0ubuntu1+esm5"}]}],"versions":["1.1.1+dfsg.1-2","1.1.2+dfsg.1-5","1.1.3+dfsg.1-1","1.1.4+dfsg.1-1","1.2~beta+dfsg.1-0ubuntu1","1.2~beta+dfsg.1-0ubuntu1+esm1","1.2~beta+dfsg.1-0ubuntu1+esm2","1.2~beta+dfsg.1-0ubuntu1+esm3","1.2~beta+dfsg.1-0ubuntu1+esm4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.3"}]}],"bundled":8}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"roundcube","product":"roundcube webmail"},{"vendor":"roundcube","product":"webmail"}],"references":[{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.3.3","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Release Notes","Third Party Advisory","report"]},{"url":"https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.1.10","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Release Notes","Third Party Advisory","report"]},{"url":"http://www.securityfocus.com/bid/101793","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.2.7","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Release Notes","Third Party Advisory","report"]},{"url":"https://www.debian.org/security/2017/dsa-4030","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/roundcube/roundcubemail/issues/6026","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-16651","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16651"},{"url":"https://github.com/advisories/GHSA-6r67-r3jm-88p4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-16651","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-16651","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0409.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-16651","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16651","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7200-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35730","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-16651","description":"Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings\u0026_action=upload-display\u0026_from=timezone requests.","status":"published","published":"2017-11-09T14:00:00Z","modified":"2025-10-21T23:55:30.379Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:33:21.453505Z"}],"euvd":[{"id":"EUVD-2017-7838","description":"Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings\u0026_action=upload-display\u0026_from=timezone requests.","status":"published","published":"2017-11-09T14:00:00Z","modified":"2025-10-21T23:55:30Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T20:31:23.427989Z"}],"ghsa":[{"id":"GHSA-6r67-r3jm-88p4","title":"Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized...","description":"Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings\u0026_action=upload-display\u0026_from=timezone requests.","status":"published","published":"2022-05-13T01:11:29Z","modified":"2025-10-22T00:32:31Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T15:04:05.954742Z"}],"kev":[{"id":"CVE-2017-16651","title":"Roundcube Webmail File Disclosure Vulnerability","description":"Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.","cwes":["CWE-552"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2017-16651","description":"Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings\u0026_action=upload-display\u0026_from=timezone requests.","status":"published","published":"2017-11-09T14:29:00.267Z","modified":"2026-06-17T01:09:37.363Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:04:08.635428Z"}],"osv":[{"id":"ALPINE-CVE-2017-16651","description":"Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings\u0026_action=upload-display\u0026_from=timezone requests.","status":"published","published":"2017-11-09T14:29:00.267Z","modified":"2026-06-15T18:24:57.139435813Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2017-16651","description":"Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings\u0026_action=upload-display\u0026_from=timezone requests.","status":"published","published":"2017-11-09T14:29:00.267Z","modified":"2026-10-20T10:48:16.131444451Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-16651","description":"Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings\u0026_action=upload-display\u0026_from=timezone requests.","status":"published","published":"2017-11-09T14:29:00.267Z","modified":"2026-09-01T20:03:45.043393819Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"UBUNTU-CVE-2017-16651","description":"Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings\u0026_action=upload-display\u0026_from=timezone requests.","status":"published","published":"2017-11-09T14:29:00Z","modified":"2026-02-04T02:26:28.103876Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"DLA-1193-1","title":"roundcube - security update","status":"published","published":"2017-11-27T00:00:00Z","modified":"2026-03-09T01:01:32.569669Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4030-1","title":"roundcube - security update","status":"published","published":"2017-11-09T00:00:00Z","modified":"2026-03-09T01:18:31.289394Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0409","title":"Updated roundcubemail packages fix security vulnerability","description":"It was discovered that roundcubemail contained a zero-day file disclosure\nvulnerability caused by insuficient input validation which was currently\nbeing exploited by hackers to read roundcube's configuration files and\nsteal its database credentials (CVE-2017-16651).\n","status":"published","published":"2017-11-16T07:39:32Z","modified":"2026-04-16T04:40:36.838571501Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:11303-1","title":"roundcubemail-1.4.11-1.3 on GA media","description":"These are all security issues fixed in the roundcubemail-1.4.11-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:06:43.051285Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-7200-1","title":"roundcube vulnerability","description":"It was discovered that Roundcube incorrectly handled certain file-based\nattachment plugins. An attacker could exploit this to gain unauthorized\naccess to arbitrary files on the host’s file system.\n","status":"published","published":"2025-01-13T11:51:10Z","modified":"2026-06-25T13:32:29.984929034Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}