{"api_version":"1","generated_at":"2026-07-23T11:04:29+00:00","cve":"CVE-2014-9587","urls":{"html":"https://cve.report/CVE-2014-9587","api":"https://cve.report/api/cve/CVE-2014-9587.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-9587","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-9587"},"summary":{"title":"CVE-2014-9587","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins.","state":"PUBLISHED","assigner":"mitre","published_at":"2015-01-15 15:59:21","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-352","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2015/01/11/3","name":"http://www.openwall.com/lists/oss-security/2015/01/11/3","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - Re: CVE request: roundcubemail: possible CSRF attacks\n to some address book operations as well as to the ACL and Managesieve plugins","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/71909","name":"http://www.securityfocus.com/bid/71909","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Roundcube Webmail Multiple Cross Site Request Forgery Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://roundcube.net/news/2014/12/18/update-1.0.4-released/","name":"http://roundcube.net/news/2014/12/18/update-1.0.4-released/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Update 1.0.4 released","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1179780","name":"https://bugzilla.redhat.com/show_bug.cgi?id=1179780","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Bug 1179780 – CVE-2014-9587 roundcubemail: possible CSRF attacks to some address book operations as well as to the ACL and Managesieve plugins","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugs.gentoo.org/show_bug.cgi?id=534766","name":"https://bugs.gentoo.org/show_bug.cgi?id=534766","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Bug 534766 – <mail-client/roundcube-1.0.4 - possible CSRF attacks to some address book operations as well as to the ACL and Managesieve plugins (CVE-2014-9587)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9587","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9587","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"9587","vulnerable":"1","versionEndIncluding":"1.0.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"roundcube","cpe5":"webmail","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T13:47:41.677Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://roundcube.net/news/2014/12/18/update-1.0.4-released/"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1179780"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://bugs.gentoo.org/show_bug.cgi?id=534766"},{"name":"71909","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/71909"},{"name":"[oss-security] 20150111 Re: CVE request: roundcubemail: possible CSRF attacks  to some address book operations as well as to the ACL and Managesieve plugins","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2015/01/11/3"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-01-07T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2015-01-15T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://roundcube.net/news/2014/12/18/update-1.0.4-released/"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1179780"},{"tags":["x_refsource_MISC"],"url":"https://bugs.gentoo.org/show_bug.cgi?id=534766"},{"name":"71909","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/71909"},{"name":"[oss-security] 20150111 Re: CVE request: roundcubemail: possible CSRF attacks  to some address book operations as well as to the ACL and Managesieve plugins","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2015/01/11/3"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-9587","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://roundcube.net/news/2014/12/18/update-1.0.4-released/","refsource":"CONFIRM","url":"http://roundcube.net/news/2014/12/18/update-1.0.4-released/"},{"name":"https://bugzilla.redhat.com/show_bug.cgi?id=1179780","refsource":"CONFIRM","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1179780"},{"name":"https://bugs.gentoo.org/show_bug.cgi?id=534766","refsource":"MISC","url":"https://bugs.gentoo.org/show_bug.cgi?id=534766"},{"name":"71909","refsource":"BID","url":"http://www.securityfocus.com/bid/71909"},{"name":"[oss-security] 20150111 Re: CVE request: roundcubemail: possible CSRF attacks  to some address book operations as well as to the ACL and Managesieve plugins","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2015/01/11/3"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-9587","datePublished":"2015-01-15T15:00:00.000Z","dateReserved":"2015-01-11T00:00:00.000Z","dateUpdated":"2024-08-06T13:47:41.677Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-01-15 15:59:21","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-352","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*","versionEndIncluding":"1.0.3","matchCriteriaId":"F0BC22E0-32B4-493F-8514-34991AED0862"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"9587","Ordinal":"1","Title":"CVE-2014-9587","CVE":"CVE-2014-9587","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"9587","Ordinal":"1","NoteData":"Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins.","Type":"Description","Title":"CVE-2014-9587"},{"CveYear":"2014","CveId":"9587","Ordinal":"2","NoteData":"2015-01-15","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"9587","Ordinal":"3","NoteData":"2015-01-15","Type":"Other","Title":"Modified"}]}}}