CVE-2014-9587

Published Jan 15, 2015

Last updated 7 days ago

Overview

Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins.
Source: cve@mitre.org
NVD status: Deferred

Risk scores

CVSS 2.0

Type: Primary
Base score: 6.8
Impact score: 6.4
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-352

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F0BC22E0-32B4-493F-8514-34991AED0862",
            "versionEndIncluding": "1.0.3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References