CVE Feed

    Dashboard / CVE / CVE-2018-1000072

    CVE-2018-1000072

    iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in Beta: 0.9.8-BETA1, Stable: 0.9.7.

    Published:Mar 13, 2018
    Last Modified:Nov 21, 2024
    EPS:Mar 13, 2018
    EPSS Score:0.00296
    CVSS Score:7.5

    Affected Products

    Vendor
    Iredmail
    Product
    Iredmail

    Exploits

    http://legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txthttps://bitbucket.org/zhb/iredmail/issues/130/multiple-security-issues-with-defaulthttp://legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txthttps://bitbucket.org/zhb/iredmail/issues/130/multiple-security-issues-with-default

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High