{"id":"CVE-2017-8114","aliases":["ALPINE-CVE-2017-8114","DEBIAN-CVE-2017-8114","DLA-933-1","EUVD-2017-17076","GHSA-4p57-8qx3-4cjv","MGASA-2017-0181","UBUNTU-CVE-2017-8114","openSUSE-SU-2024:11303-1"],"status":"published","title":"Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions...","description":"Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03471,"percentile":0.89153,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2017-04-29T19:00:00Z","modified":"2026-10-24T10:30:46Z","fixes":[{"ecosystem":"Alpine:v3.2","package":"roundcubemail","fixed_in":["1.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"roundcubemail","fixed_in":["1.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"roundcubemail","fixed_in":["1.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"roundcubemail","fixed_in":["1.2.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"roundcube","fixed_in":["1.2.3+dfsg.1-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"roundcube","fixed_in":["1.2.3+dfsg.1-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"roundcube","fixed_in":["1.2.3+dfsg.1-4"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"roundcube","fixed_in":["0.7.2-9+deb7u7"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"roundcubemail","fixed_in":["1.0.11-1.mga5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"roundcube","fixed_in":["1.2~beta+dfsg.1-0ubuntu1+esm7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.2","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3+dfsg.1-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3+dfsg.1-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3+dfsg.1-4"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2-9+deb7u7"}]}],"versions":["0.7.2-9","0.7.2-9+deb7u1","0.7.2-9+deb7u2","0.7.2-9+deb7u3","0.7.2-9+deb7u4","0.7.2-9+deb7u5","0.7.2-9+deb7u6"]},{"source":"osv","ecosystem":"Mageia:5","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.11-1.mga5"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2~beta+dfsg.1-0ubuntu1+esm7"}]}],"versions":["1.1.1+dfsg.1-2","1.1.2+dfsg.1-5","1.1.3+dfsg.1-1","1.1.4+dfsg.1-1","1.2~beta+dfsg.1-0ubuntu1","1.2~beta+dfsg.1-0ubuntu1+esm1","1.2~beta+dfsg.1-0ubuntu1+esm2","1.2~beta+dfsg.1-0ubuntu1+esm3","1.2~beta+dfsg.1-0ubuntu1+esm4","1.2~beta+dfsg.1-0ubuntu1+esm5","1.2~beta+dfsg.1-0ubuntu1+esm6"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.3"}]}],"bundled":8}],"products":[{"vendor":"roundcube","product":"webmail"}],"references":[{"url":"https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201707-11","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/98445","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8114"},{"url":"https://github.com/advisories/GHSA-4p57-8qx3-4cjv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-8114","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-8114","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0181.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20787","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8114/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-8114","tags":["report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.2.5","tags":["report"]},{"url":"https://github.com/roundcube/roundcubemail/commit/6e054a37d13dc3772d0aa454a32d5dc3bdcc7003","tags":["report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.1.9","tags":["report"]},{"url":"https://github.com/roundcube/roundcubemail/commit/10b227d70a03e33682aaaa0138e84f9256f3cd50","tags":["report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.0.11","tags":["report"]},{"url":"https://github.com/roundcube/roundcubemail/commit/271426429bfbb5b63e6dec91b1e4780e8ef1c67e","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-8114","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8132-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35730","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-8114","description":"Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.","status":"published","published":"2017-04-29T19:00:00Z","modified":"2024-08-05T16:27:22.799Z","updated_at":"2026-11-02T14:33:15.201133Z"}],"euvd":[{"id":"EUVD-2017-17076","description":"Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.","status":"published","published":"2017-04-29T19:00:00Z","modified":"2024-08-05T16:27:22Z","updated_at":"2026-11-03T02:39:05.933017Z"}],"ghsa":[{"id":"GHSA-4p57-8qx3-4cjv","title":"Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions...","description":"Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.","status":"published","published":"2022-05-13T01:47:16Z","modified":"2023-01-27T05:04:27Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:42:27.785329Z"}],"nvd":[{"id":"CVE-2017-8114","description":"Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.","status":"published","published":"2017-04-29T19:59:00.217Z","modified":"2026-06-17T01:25:47.72Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:03:47.848196Z"}],"osv":[{"id":"ALPINE-CVE-2017-8114","description":"Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.","status":"published","published":"2017-04-29T19:59:00.217Z","modified":"2026-06-15T18:25:00.650939884Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"CVE-2017-8114","description":"Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.","status":"published","published":"2017-04-29T19:59:00.217Z","modified":"2026-10-24T10:30:46.628994085Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DEBIAN-CVE-2017-8114","description":"Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.","status":"published","published":"2017-04-29T19:59:00.217Z","modified":"2026-09-01T20:03:50.725002294Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-8114","description":"Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.","status":"published","published":"2017-04-29T19:59:00Z","modified":"2026-03-31T17:54:06.379401Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"DLA-933-1","title":"roundcube - security update","status":"published","published":"2017-05-07T00:00:00Z","modified":"2026-03-09T02:09:57.517048Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"MGASA-2017-0181","title":"Updated roundcubemail packages fix security vulnerability","description":"It was discovered that roundcubemail prior to 1.0.11 contained a\nvulnerability in the virtualmin and sasl drivers of the password plugin\n(CVE-2017-8114)\n","status":"published","published":"2017-06-26T09:28:17Z","modified":"2026-04-16T06:24:30.764720237Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:11303-1","title":"roundcubemail-1.4.11-1.3 on GA media","description":"These are all security issues fixed in the roundcubemail-1.4.11-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:06:43.051285Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}