| Package | Affected versions | Patched versions |
|---|---|---|
| webmail | ≥ 1.1.0, < 1.1.9≥ 1.2.0, < 1.2.5< 1.0.11 | 1.1.91.2.51.0.11 |
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free