Vulnerability Description
Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Roundcube | Roundcube Webmail | <= 1.0.5 |
Related Weaknesses (CWE)
References
- http://trac.roundcube.net/changeset/6ccd4c54b/github
- http://trac.roundcube.net/changeset/e84fafcec/github
- http://trac.roundcube.net/ticket/1490379
- https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/PatchVendor Advisory
- http://trac.roundcube.net/changeset/6ccd4c54b/github
- http://trac.roundcube.net/changeset/e84fafcec/github
- http://trac.roundcube.net/ticket/1490379
- https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/PatchVendor Advisory
FAQ
What is CVE-2015-8794?
CVE-2015-8794 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathn...
How severe is CVE-2015-8794?
CVE-2015-8794 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-8794?
Check the references section above for vendor advisories and patch information. Affected products include: Roundcube Roundcube Webmail.