| Package | Affected versions | Patched versions |
|---|---|---|
| webmail | ≥ 1.6.0, < 1.6.18≥ 1.7.0, < 1.7.3 | 1.6.181.7.3 |
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free