| Package | Affected versions | Patched versions |
|---|---|---|
| webmail | = 0.1= 0.1.1= 0.2= 0.2.1= 0.2.2= 0.3= 0.3.1= 0.4= 0.4.1= 0.4.2= 0.5= 0.5.1= 0.5.2= 0.5.3= 0.5.4= 0.6= 0.7= 0.7.1= 0.7.2= 0.7.3= 0.8.0= 0.8.1= 0.8.2= 0.8.3= 0.8.4= 0.8.5= 0.9= 0.9.0= 0.9.1= 0.9.2= 0.9.3= 0.9.4≤ 0.8.6 |
steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free