CVE-2017-8114

{"id": "CVE-2017-8114", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2017-04-29T19:59:00.217", "references": [{"url": "http://www.securityfocus.com/bid/98445", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://security.gentoo.org/glsa/201707-11", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin."}, {"lang": "es", "value": "Roundcube Webmail permite reinicios de contrase\u00f1a arbitrarios por usuarios autenticados. Esto afecta a las versiones anteriores a la 1.0.11, entre la 1.1.x y la 1.1.9 y entre la 1.2.x y la 1.2.5. El problema es causado por una llamada exec incorrectamente restringida en los controladores virtualmin y sasl del plugin de contrase\u00f1a."}], "lastModified": "2022-09-27T18:16:51.703", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C97476E5-142E-447C-8C81-16BB6073E8D3", "versionEndExcluding": "1.0.11"}, {"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F8B912A-5567-48A4-A9FA-D1333BC1969B", "versionEndExcluding": "1.1.9", "versionStartIncluding": "1.1.0"}, {"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "701E49A8-499B-4092-927A-D4B9276ACEA8", "versionEndExcluding": "1.2.5", "versionStartIncluding": "1.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}