CVE-2015-5383

Published: May 23, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.

Affected (4)

Products: Roundcube: Roundcube Webmail, Webmail

Roundcube

2 products

Roundcube Webmail

Webmail

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Roundcube Roundcube Webmail	Version 1.1.1
Roundcube Webmail	Version 1.1
Roundcube Webmail	Version 1.1 beta
Roundcube Webmail	Version 1.1 rc

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (8)

http://www.openwall.com/lists/oss-security/2015/07/07/2

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/roundcube/roundcubemail/issues/4816

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released

Source: cve@mitre.org

PatchVendor Advisory

http://www.openwall.com/lists/oss-security/2015/07/07/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://github.com/roundcube/roundcubemail/issues/4816

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.