GCVE - cpe:2.3:a:roundcube:webmail:1.2.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:roundcube:webmail:1.2.1:*:*:*:*:*:*:*

part: a version: 1.2.1 update: *

Vendor	Roundcube (`e9332c9d-8d56-558e-b31a-ef4bbc8643b9`)
Product	Webmail (`aca6980c-c41a-59dc-91cb-067d061f918a`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:docker/roundcube/roundcubemail`	purl2cpe	2026-06-01 10:11:31.612102
`pkg:github/roundcube/roundcubemail`	purl2cpe	2026-06-01 10:11:31.612103
`pkg:rpm/fedora/roundcubemail`	purl2cpe	2026-06-01 10:11:31.612104
`pkg:rpm/opensuse/roundcubemail`	purl2cpe	2026-06-01 10:11:31.612106

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-6820`	vulnerable	2026-06-08 05:09:55.003730	Details available rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element. Published: 2017-03-12T04:57:00.000Z Updated: 2024-08-05T15:41:17.592Z Open on db.gcve.eu Reference links https://github.com/roundcube/roundcubemail/wiki/Changelog#release-124 https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db00d28ecc1554e9f4 https://github.com/roundcube/roundcubemail/releases/tag/1.1.8 https://github.com/roundcube/roundcubemail/releases/tag/1.2.4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-16651`	vulnerable	2026-06-08 05:09:00.689237	Details available Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests. Published: 2017-11-09T14:00:00.000Z Updated: 2025-10-21T23:55:30.379Z Open on db.gcve.eu Reference links https://github.com/roundcube/roundcubemail/releases/tag/1.3.3 https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10 https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html https://github.com/roundcube/roundcubemail/releases/tag/1.1.10 http://www.securityfocus.com/bid/101793	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-9920`	vulnerable	2026-06-08 05:08:24.975274	Details available steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message. Published: 2016-12-08T18:00:00.000Z Updated: 2024-08-06T03:07:31.413Z Open on db.gcve.eu Reference links https://blog.ripstech.com/2016/roundcube-command-execution-via-email/ http://www.securityfocus.com/bid/94858 http://www.openwall.com/lists/oss-security/2016/12/08/10 https://roundcube.net/news/2016/11/28/updates-1.2.3-and-1.1.7-released https://security.gentoo.org/glsa/201612-44	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.