CVE-2017-16651
Summary
| CVE | CVE-2017-16651 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-11-09 14:29:00 UTC |
| Updated | 2026-04-21 18:00:40 UTC |
| Description | Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests. |
Risk And Classification
Primary CVSS: v3.1 7.8 HIGH from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.372710000 probability, percentile 0.971900000 (date 2026-04-22)
CISA KEV: Listed on 2021-11-03; due 2022-05-03; ransomware use Unknown
Problem Types: CWE-552 | n/a | CWE-552 CWE-552 Files or Directories Accessible to External Parties
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | ADP | DECLARED | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:L/AC:L/Au:N/C:P/I:P/A:P
CISA Known Exploited Vulnerability
| Vendor | Roundcube |
|---|---|
| Product | Roundcube Webmail |
| Name | Roundcube Webmail File Disclosure Vulnerability |
| Required Action | Apply updates per vendor instructions. |
| Notes | https://nvd.nist.gov/vuln/detail/CVE-2017-16651 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 7.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Application | Roundcube | Webmail | 1.2.0 | All | All | All |
| Application | Roundcube | Webmail | 1.2.1 | All | All | All |
| Application | Roundcube | Webmail | 1.2.2 | All | All | All |
| Application | Roundcube | Webmail | 1.2.3 | All | All | All |
| Application | Roundcube | Webmail | 1.2.4 | All | All | All |
| Application | Roundcube | Webmail | 1.2.5 | All | All | All |
| Application | Roundcube | Webmail | 1.2.6 | All | All | All |
| Application | Roundcube | Webmail | 1.3.0 | All | All | All |
| Application | Roundcube | Webmail | 1.3.1 | All | All | All |
| Application | Roundcube | Webmail | 1.3.2 | All | All | All |
| Application | Roundcube | Webmail | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Roundcube Webmail 1.2 File Disclosure ≈ Packet Storm | af854a3a-2127-422b-91ae-364da2661108 | packetstormsecurity.com | Exploit, Third Party Advisory, VDB Entry |
| Security updates 1.3.3, 1.2.7 and 1.1.10 released | af854a3a-2127-422b-91ae-364da2661108 | roundcube.net | Issue Tracking, Vendor Advisory |
| Release [Security Update] Roundcube Webmail 1.2.7 · roundcube/roundcubemail · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Issue Tracking, Release Notes, Third Party Advisory |
| File Disclosure Vulnerability · Issue #6026 · roundcube/roundcubemail · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Issue Tracking, Patch, Third Party Advisory |
| Debian -- Security Information -- DSA-4030-1 roundcube | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | Issue Tracking, Third Party Advisory |
| Roundcube Webmail CVE-2017-16651 Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| www.cisa.gov/known-exploited-vulnerabilities-catalog | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | www.cisa.gov | US Government Resource |
| [SECURITY] [DLA 1193-1] roundcube security update | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | Mailing List, Third Party Advisory |
| Release [Security Update] Roundcube Webmail 1.1.10 · roundcube/roundcubemail · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Issue Tracking, Release Notes, Third Party Advisory |
| Release [Security Update] Roundcube Webmail 1.3.3 · roundcube/roundcubemail · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Issue Tracking, Release Notes, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2021-11-03T00:00:00.000Z | CVE-2017-16651 added to CISA KEV |
There are currently no legacy QID mappings associated with this CVE.