Roundcube Webmail CVE-2017-16651 Information Disclosure Vulnerability

Bugtraq ID:	101793
Class:	Input Validation Error
CVE:	CVE-2017-16651
Remote:	Yes
Local:	No
Published:	Nov 09 2017 12:00AM
Updated:	Dec 19 2017 09:00PM
Credit:	david67810.
Vulnerable:	Roundcube Webmail 1.3 Roundcube Webmail 1.2.5 Roundcube Webmail 1.2 Roundcube Webmail 1.1.9 Roundcube Webmail 1.1.5 Roundcube Webmail 1.1.4 Roundcube Webmail 1.1.3 Roundcube Webmail 1.1.2 Roundcube Webmail 1.1.1 Roundcube Webmail 0.1.1 Roundcube Webmail 1.2.4 Roundcube Webmail 1.2.3 Roundcube Webmail 1.1.8 Roundcube Webmail 1.1.7 Roundcube Webmail 1.1.0
Not Vulnerable:	Roundcube Webmail 1.3.3 Roundcube Webmail 1.2.7 Roundcube Webmail 1.1.10

Roundcube Webmail CVE-2017-16651 Information Disclosure Vulnerability

Reports indicate that this issue is being exploited in the wild. Please see the references for more information.

Roundcube Webmail CVE-2017-16651 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Roundcube Webmail CVE-2017-16651 Information Disclosure Vulnerability

References:

• RoundCube Webmail Homepage (RoundCube)
  
• DSA-4030-1 roundcube -- security update (Debian)
  
• File Disclosure Vulnerability #6026 (Roundcube)
  
• Security updates 1.3.3, 1.2.7 and 1.1.10 released (Roundcube)