GCVE - cpe:2.3:a:roundcube:webmail:1.2.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:roundcube:webmail:1.2.3:*:*:*:*:*:*:*

part: a version: 1.2.3 update: *

Vendor	Roundcube (`e9332c9d-8d56-558e-b31a-ef4bbc8643b9`)
Product	Webmail (`aca6980c-c41a-59dc-91cb-067d061f918a`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:docker/roundcube/roundcubemail`	purl2cpe	2026-06-01 10:11:31.612140
`pkg:github/roundcube/roundcubemail`	purl2cpe	2026-06-01 10:11:31.612142
`pkg:rpm/fedora/roundcubemail`	purl2cpe	2026-06-01 10:11:31.612143
`pkg:rpm/opensuse/roundcubemail`	purl2cpe	2026-06-01 10:11:31.612145

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-6820`	vulnerable	2026-06-08 05:09:55.004803	Details available rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element. Published: 2017-03-12T04:57:00.000Z Updated: 2024-08-05T15:41:17.592Z Open on db.gcve.eu Reference links https://github.com/roundcube/roundcubemail/wiki/Changelog#release-124 https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db00d28ecc1554e9f4 https://github.com/roundcube/roundcubemail/releases/tag/1.1.8 https://github.com/roundcube/roundcubemail/releases/tag/1.2.4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-16651`	vulnerable	2026-06-08 05:09:00.690211	Details available Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests. Published: 2017-11-09T14:00:00.000Z Updated: 2025-10-21T23:55:30.379Z Open on db.gcve.eu Reference links https://github.com/roundcube/roundcubemail/releases/tag/1.3.3 https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10 https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html https://github.com/roundcube/roundcubemail/releases/tag/1.1.10 http://www.securityfocus.com/bid/101793	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.