CVE-2015-8770

Published: Jan 29, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: NVD

Description

Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.

Affected (5)

Products: Roundcube: Roundcube Webmail

1 product

Roundcube Webmail

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Roundcube Roundcube Webmail	Up to 1.0.7
Roundcube Roundcube Webmail	Version 1.1.0
Roundcube Roundcube Webmail	Version 1.1.1
Roundcube Roundcube Webmail	Version 1.1.2
Roundcube Roundcube Webmail	Version 1.1.3

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (24)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00028.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00029.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00030.html

Source: cve@mitre.org

http://packetstormsecurity.com/files/135274/Roundcube-1.1.3-Path-Traversal.html

Source: cve@mitre.org

Exploit

http://trac.roundcube.net/changeset/10e5192a2b/github

Source: cve@mitre.org

http://trac.roundcube.net/ticket/1490620

Source: cve@mitre.org

http://www.debian.org/security/2016/dsa-3541

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/537304/100/0/threaded

Source: cve@mitre.org

https://roundcube.net/news/2015/12/26/updates-1.1.4-and-1.0.8-released/

Source: cve@mitre.org

PatchVendor Advisory

https://security.gentoo.org/glsa/201603-03

Source: cve@mitre.org

https://www.exploit-db.com/exploits/39245/

Source: cve@mitre.org

https://www.htbridge.com/advisory/HTB23283

Source: cve@mitre.org

Exploit

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00028.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00029.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00030.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://packetstormsecurity.com/files/135274/Roundcube-1.1.3-Path-Traversal.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://trac.roundcube.net/changeset/10e5192a2b/github

Source: af854a3a-2127-422b-91ae-364da2661108

http://trac.roundcube.net/ticket/1490620

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2016/dsa-3541

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/537304/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

https://roundcube.net/news/2015/12/26/updates-1.1.4-and-1.0.8-released/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://security.gentoo.org/glsa/201603-03

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/39245/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.htbridge.com/advisory/HTB23283

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.