Vulnerability-Lookup

CVE-2013-1904 (GCVE-0-2013-1904)

Vulnerability from cvelistv5 – Published: 2014-02-08 00:00 – Updated: 2024-08-06 15:20

Previdian

Summary

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

5 references

URL	Tags
http://habrahabr.ru/post/174423/	x_refsource_MISC
http://sourceforge.net/p/roundcubemail/news/2013/…	x_refsource_CONFIRM
http://lists.roundcube.net/pipermail/dev/2013-Mar…	mailing-listx_refsource_MLIST
http://lists.opensuse.org/opensuse-updates/2013-0…	vendor-advisoryx_refsource_SUSE
http://www.openwall.com/lists/oss-security/2013/03/28/8	mailing-listx_refsource_MLIST

Date Public

2013-03-27 00:00

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 53763cc8-79cf-4d7d-bd45-e50c4d46a52c

Vulnerability ID: CVE-2013-1904

Status: Confirmed

Status Updated: 2014-02-08 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2014-02-08

Asserted: 2014-02-08

Scope

Notes: KEVIntel entry: Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers... | Affected: Roundcube / Webmail | CVSS: 5.0 (MEDIUM) | Used in malware: unknown | Not yet in CISA KEV: True

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers...
Vendor	Roundcube
Product	Webmail
Added Date	2014-02-08T00:00:00.000Z
Cvss Score	5.0
Epss Score	None
Cvss Severity	MEDIUM
Epss Percentile	None
Used In Malware	unknown
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	True

References

Created: 2026-06-23 14:04 UTC | Updated: 2026-07-10 06:14 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T15:20:37.192Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://habrahabr.ru/post/174423/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/"
          },
          {
            "name": "[dev] 20130327 [RCD] zero day vulnerability (tested on v8.0 to 9.0)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.roundcube.net/pipermail/dev/2013-March/022328.html"
          },
          {
            "name": "openSUSE-SU-2013:0671",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html"
          },
          {
            "name": "[oss-security] 20130328 Re: CVE Request -- roundcubemail: Local file inclusion  via web UI modification of certain config options",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2013/03/28/8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-03-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-02-07T22:57:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://habrahabr.ru/post/174423/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/"
        },
        {
          "name": "[dev] 20130327 [RCD] zero day vulnerability (tested on v8.0 to 9.0)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.roundcube.net/pipermail/dev/2013-March/022328.html"
        },
        {
          "name": "openSUSE-SU-2013:0671",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html"
        },
        {
          "name": "[oss-security] 20130328 Re: CVE Request -- roundcubemail: Local file inclusion  via web UI modification of certain config options",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2013/03/28/8"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2013-1904",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://habrahabr.ru/post/174423/",
              "refsource": "MISC",
              "url": "http://habrahabr.ru/post/174423/"
            },
            {
              "name": "http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/",
              "refsource": "CONFIRM",
              "url": "http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/"
            },
            {
              "name": "[dev] 20130327 [RCD] zero day vulnerability (tested on v8.0 to 9.0)",
              "refsource": "MLIST",
              "url": "http://lists.roundcube.net/pipermail/dev/2013-March/022328.html"
            },
            {
              "name": "openSUSE-SU-2013:0671",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html"
            },
            {
              "name": "[oss-security] 20130328 Re: CVE Request -- roundcubemail: Local file inclusion  via web UI modification of certain config options",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2013/03/28/8"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2013-1904",
    "datePublished": "2014-02-08T00:00:00.000Z",
    "dateReserved": "2013-02-19T00:00:00.000Z",
    "dateUpdated": "2024-08-06T15:20:37.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2013-1904",
      "date": "2026-09-15",
      "epss": "0.02287",
      "percentile": "0.82259"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"0.7.2\", \"matchCriteriaId\": \"63B0A1D9-711E-4694-9580-4144A54A6843\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.1:20050811:*:*:*:*:*:*\", \"matchCriteriaId\": \"6E525B8F-ED49-494A-A9C1-CCFFDCFAAA11\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.1:20050820:*:*:*:*:*:*\", \"matchCriteriaId\": \"A9C38F5E-A79B-45F4-AD0C-894DE7ADD8EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.1:20051007:*:*:*:*:*:*\", \"matchCriteriaId\": \"8BDB7224-1922-41BC-82F1-187DEEEE60DA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.1:20051021:*:*:*:*:*:*\", \"matchCriteriaId\": \"9019C121-5D96-4967-92FA-AA63FAD40435\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*\", \"matchCriteriaId\": \"8F433741-5F73-43B5-A522-C484C64C66A7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*\", \"matchCriteriaId\": \"09DF755B-041E-4A61-BEF6-A613F6F0CE13\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*\", \"matchCriteriaId\": \"34D20437-7DE7-4DB8-8C11-37B09A87E3A4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"55FB4AA3-3528-46B7-BBB9-9185DAA5425C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"066AA2BC-95A8-43E8-A1FE-9F15860691E1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.1:stable:*:*:*:*:*:*\", \"matchCriteriaId\": \"BADA5A07-C90D-4000-A973-0A918E390D5F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"82FB886B-35A4-4A8C-AE18-62C845886018\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"83FF6973-9BAC-4DF2-BACE-42F0D9340A27\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*\", \"matchCriteriaId\": \"EB6449FD-C6EE-497C-BE34-88900883AD09\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*\", \"matchCriteriaId\": \"0CEF8BF6-E09F-4376-B089-9B722A84F591\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.2:stable:*:*:*:*:*:*\", \"matchCriteriaId\": \"84126D1E-F709-4F23-A541-B92B6ED01D3D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"946B0B6A-46D3-46B9-BD1E-B03D3339EEB3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.2.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0D572A44-701A-4D6F-919F-AB8AE4BF4417\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D4D6EA96-EE58-47C3-B545-7238B3F64941\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*\", \"matchCriteriaId\": \"3584BB62-818D-4A5B-BC7D-EAB0B85614EA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"332FF744-3682-4818-9602-8F868BF0781E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.3:stable:*:*:*:*:*:*\", \"matchCriteriaId\": \"141BFB80-F895-482C-B2ED-A6FB9135EA9B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2B502047-4DDD-4586-978C-6CEE1C41F923\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"43581564-48CF-410C-9CE1-CBAE71153DA5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*\", \"matchCriteriaId\": \"6A5CC548-05E4-4059-8252-FA78ECBB95A0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C3FA495A-D7FE-4461-AF57-EB649A1C49B6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2D773E61-113A-4EE8-804E-0584B73AB58D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B276CD07-EB81-4C59-B0E8-83E43EAAB005\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*\", \"matchCriteriaId\": \"FC0D4825-F78E-40F5-A9CB-45B73DE8FBD4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*\", \"matchCriteriaId\": \"9C8376B9-4DF2-4E23-9C43-EEDE3D800519\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.5.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"08BC43EB-D26F-48D7-A614-76FAEC07DB82\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.5.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1E653FFD-AA00-4F30-B844-85AFA5A5A31B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.5.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BBA46B2E-0FEA-4B17-8E72-381656E07349\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.5.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C1DC5945-5C18-40F2-AC79-32FF740A7F61\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B6230C0E-D3A2-4A2E-B6F1-E0695F6E8802\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"589AFC14-DC69-4B0B-B22B-74A8B40D63E8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.7.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"13A61889-D3B2-46A4-A9A8-60136F8A490B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.8.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"04DC85A0-F2AB-4A89-A3B9-853BAB1E0CD4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.8.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CF5C1C76-D1A6-4E22-AE50-8AE587F83AAE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.8.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"594EE4E3-9618-4E3C-8278-7782034184F9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.8.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"607FF56D-EB06-434B-925F-D83763F4555B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.8.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DEC9286A-9537-4F18-8C73-61DE4506583B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:roundcube:webmail:0.8.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4711358C-B12B-4B48-9AF8-49C8298BA451\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de recorrido de directorio absoluto en steps/mail/sendmail.inc en Roundcube Webmail anterior a 0.7.3 y 0.8.x anterior a 0.8.6 permite a atacantes remotos leer archivos arbitrarios a trav\\u00e9s de una ruta completa en el par\\u00e1metro _value para la configuraci\\u00f3n generic_message_footer en una acci\\u00f3n save-perf hacia index.php, tal y como se explot\\u00f3 activamente en marzo de 2013.\"}]",
      "id": "CVE-2013-1904",
      "lastModified": "2024-11-21T01:50:37.570",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2014-02-08T00:55:05.957",
      "references": "[{\"url\": \"http://habrahabr.ru/post/174423/\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://lists.roundcube.net/pipermail/dev/2013-March/022328.html\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Patch\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2013/03/28/8\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://habrahabr.ru/post/174423/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.roundcube.net/pipermail/dev/2013-March/022328.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2013/03/28/8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-22\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2013-1904\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2014-02-08T00:55:05.957\",\"lastModified\":\"2026-04-29T01:13:23.040\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de recorrido de directorio absoluto en steps/mail/sendmail.inc en Roundcube Webmail anterior a 0.7.3 y 0.8.x anterior a 0.8.6 permite a atacantes remotos leer archivos arbitrarios a trav\u00e9s de una ruta completa en el par\u00e1metro _value para la configuraci\u00f3n generic_message_footer en una acci\u00f3n save-perf hacia index.php, tal y como se explot\u00f3 activamente en marzo de 2013.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"0.7.2\",\"matchCriteriaId\":\"63B0A1D9-711E-4694-9580-4144A54A6843\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.1:20050811:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E525B8F-ED49-494A-A9C1-CCFFDCFAAA11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.1:20050820:*:*:*:*:*:*\",\"matchCriteriaId\":\"A9C38F5E-A79B-45F4-AD0C-894DE7ADD8EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.1:20051007:*:*:*:*:*:*\",\"matchCriteriaId\":\"8BDB7224-1922-41BC-82F1-187DEEEE60DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.1:20051021:*:*:*:*:*:*\",\"matchCriteriaId\":\"9019C121-5D96-4967-92FA-AA63FAD40435\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F433741-5F73-43B5-A522-C484C64C66A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"09DF755B-041E-4A61-BEF6-A613F6F0CE13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"34D20437-7DE7-4DB8-8C11-37B09A87E3A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"55FB4AA3-3528-46B7-BBB9-9185DAA5425C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"066AA2BC-95A8-43E8-A1FE-9F15860691E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.1:stable:*:*:*:*:*:*\",\"matchCriteriaId\":\"BADA5A07-C90D-4000-A973-0A918E390D5F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"82FB886B-35A4-4A8C-AE18-62C845886018\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"83FF6973-9BAC-4DF2-BACE-42F0D9340A27\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB6449FD-C6EE-497C-BE34-88900883AD09\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CEF8BF6-E09F-4376-B089-9B722A84F591\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.2:stable:*:*:*:*:*:*\",\"matchCriteriaId\":\"84126D1E-F709-4F23-A541-B92B6ED01D3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"946B0B6A-46D3-46B9-BD1E-B03D3339EEB3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D572A44-701A-4D6F-919F-AB8AE4BF4417\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D4D6EA96-EE58-47C3-B545-7238B3F64941\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"3584BB62-818D-4A5B-BC7D-EAB0B85614EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"332FF744-3682-4818-9602-8F868BF0781E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.3:stable:*:*:*:*:*:*\",\"matchCriteriaId\":\"141BFB80-F895-482C-B2ED-A6FB9135EA9B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B502047-4DDD-4586-978C-6CEE1C41F923\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"43581564-48CF-410C-9CE1-CBAE71153DA5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"6A5CC548-05E4-4059-8252-FA78ECBB95A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C3FA495A-D7FE-4461-AF57-EB649A1C49B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D773E61-113A-4EE8-804E-0584B73AB58D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B276CD07-EB81-4C59-B0E8-83E43EAAB005\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC0D4825-F78E-40F5-A9CB-45B73DE8FBD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C8376B9-4DF2-4E23-9C43-EEDE3D800519\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"08BC43EB-D26F-48D7-A614-76FAEC07DB82\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1E653FFD-AA00-4F30-B844-85AFA5A5A31B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.5.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BBA46B2E-0FEA-4B17-8E72-381656E07349\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.5.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1DC5945-5C18-40F2-AC79-32FF740A7F61\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6230C0E-D3A2-4A2E-B6F1-E0695F6E8802\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"589AFC14-DC69-4B0B-B22B-74A8B40D63E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.7.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"13A61889-D3B2-46A4-A9A8-60136F8A490B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"04DC85A0-F2AB-4A89-A3B9-853BAB1E0CD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.8.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF5C1C76-D1A6-4E22-AE50-8AE587F83AAE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.8.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"594EE4E3-9618-4E3C-8278-7782034184F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.8.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"607FF56D-EB06-434B-925F-D83763F4555B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.8.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEC9286A-9537-4F18-8C73-61DE4506583B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:roundcube:webmail:0.8.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4711358C-B12B-4B48-9AF8-49C8298BA451\"}]}]}],\"references\":[{\"url\":\"http://habrahabr.ru/post/174423/\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.roundcube.net/pipermail/dev/2013-March/022328.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2013/03/28/8\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://habrahabr.ru/post/174423/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.roundcube.net/pipermail/dev/2013-March/022328.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2013/03/28/8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "current_release_date": "2025-11-21T12:35:27+00:00",
      "cve": "CVE-2013-1904",
      "id": "CVE-2013-1904",
      "initial_release_date": "2013-03-27T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "roundcubemail: Local file inclusion via web UI modification of certain config options",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2013/cve-2013-1904.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2023-12-08T04:57:28Z",
      "cve": "CVE-2013-1904",
      "id": "CVE-2013-1904",
      "initial_release_date": "2023-02-15T05:39:47Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2013-1904",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2013-1904.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2013-1904

Vulnerability from fkie_nvd - Published: 2014-02-08 00:55 - Updated: 2026-06-16 23:52

Previdian

Severity

Summary

References

URL	Tags
secalert@redhat.com	http://habrahabr.ru/post/174423/
secalert@redhat.com	http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html
secalert@redhat.com	http://lists.roundcube.net/pipermail/dev/2013-March/022328.html	Vendor Advisory
secalert@redhat.com	http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/	Patch
secalert@redhat.com	http://www.openwall.com/lists/oss-security/2013/03/28/8
af854a3a-2127-422b-91ae-364da2661108	http://habrahabr.ru/post/174423/
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.roundcube.net/pipermail/dev/2013-March/022328.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/	Patch
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2013/03/28/8

Impacted products

Vendor	Product	Version
roundcube	webmail	*
roundcube	webmail	0.1
roundcube	webmail	0.1
roundcube	webmail	0.1
roundcube	webmail	0.1
roundcube	webmail	0.1
roundcube	webmail	0.1
roundcube	webmail	0.1
roundcube	webmail	0.1
roundcube	webmail	0.1
roundcube	webmail	0.1
roundcube	webmail	0.1
roundcube	webmail	0.1.1
roundcube	webmail	0.2
roundcube	webmail	0.2
roundcube	webmail	0.2
roundcube	webmail	0.2
roundcube	webmail	0.2.1
roundcube	webmail	0.2.2
roundcube	webmail	0.3
roundcube	webmail	0.3
roundcube	webmail	0.3
roundcube	webmail	0.3
roundcube	webmail	0.3.1
roundcube	webmail	0.4
roundcube	webmail	0.4
roundcube	webmail	0.4.1
roundcube	webmail	0.4.2
roundcube	webmail	0.5
roundcube	webmail	0.5
roundcube	webmail	0.5
roundcube	webmail	0.5.1
roundcube	webmail	0.5.2
roundcube	webmail	0.5.3
roundcube	webmail	0.5.4
roundcube	webmail	0.6
roundcube	webmail	0.7
roundcube	webmail	0.7.1
roundcube	webmail	0.8.0
roundcube	webmail	0.8.1
roundcube	webmail	0.8.2
roundcube	webmail	0.8.3
roundcube	webmail	0.8.4
roundcube	webmail	0.8.5

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "63B0A1D9-711E-4694-9580-4144A54A6843",
              "versionEndIncluding": "0.7.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050811:*:*:*:*:*:*",
              "matchCriteriaId": "6E525B8F-ED49-494A-A9C1-CCFFDCFAAA11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050820:*:*:*:*:*:*",
              "matchCriteriaId": "A9C38F5E-A79B-45F4-AD0C-894DE7ADD8EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051007:*:*:*:*:*:*",
              "matchCriteriaId": "8BDB7224-1922-41BC-82F1-187DEEEE60DA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051021:*:*:*:*:*:*",
              "matchCriteriaId": "9019C121-5D96-4967-92FA-AA63FAD40435",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*",
              "matchCriteriaId": "8F433741-5F73-43B5-A522-C484C64C66A7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
              "matchCriteriaId": "09DF755B-041E-4A61-BEF6-A613F6F0CE13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "34D20437-7DE7-4DB8-8C11-37B09A87E3A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "55FB4AA3-3528-46B7-BBB9-9185DAA5425C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "066AA2BC-95A8-43E8-A1FE-9F15860691E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1:stable:*:*:*:*:*:*",
              "matchCriteriaId": "BADA5A07-C90D-4000-A973-0A918E390D5F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "82FB886B-35A4-4A8C-AE18-62C845886018",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*",
              "matchCriteriaId": "EB6449FD-C6EE-497C-BE34-88900883AD09",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*",
              "matchCriteriaId": "0CEF8BF6-E09F-4376-B089-9B722A84F591",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.2:stable:*:*:*:*:*:*",
              "matchCriteriaId": "84126D1E-F709-4F23-A541-B92B6ED01D3D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "946B0B6A-46D3-46B9-BD1E-B03D3339EEB3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D572A44-701A-4D6F-919F-AB8AE4BF4417",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "D4D6EA96-EE58-47C3-B545-7238B3F64941",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*",
              "matchCriteriaId": "3584BB62-818D-4A5B-BC7D-EAB0B85614EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "332FF744-3682-4818-9602-8F868BF0781E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.3:stable:*:*:*:*:*:*",
              "matchCriteriaId": "141BFB80-F895-482C-B2ED-A6FB9135EA9B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B502047-4DDD-4586-978C-6CEE1C41F923",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "43581564-48CF-410C-9CE1-CBAE71153DA5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*",
              "matchCriteriaId": "6A5CC548-05E4-4059-8252-FA78ECBB95A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C3FA495A-D7FE-4461-AF57-EB649A1C49B6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D773E61-113A-4EE8-804E-0584B73AB58D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "B276CD07-EB81-4C59-B0E8-83E43EAAB005",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*",
              "matchCriteriaId": "FC0D4825-F78E-40F5-A9CB-45B73DE8FBD4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*",
              "matchCriteriaId": "9C8376B9-4DF2-4E23-9C43-EEDE3D800519",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "08BC43EB-D26F-48D7-A614-76FAEC07DB82",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E653FFD-AA00-4F30-B844-85AFA5A5A31B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "BBA46B2E-0FEA-4B17-8E72-381656E07349",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1DC5945-5C18-40F2-AC79-32FF740A7F61",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "B6230C0E-D3A2-4A2E-B6F1-E0695F6E8802",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "589AFC14-DC69-4B0B-B22B-74A8B40D63E8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "13A61889-D3B2-46A4-A9A8-60136F8A490B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "04DC85A0-F2AB-4A89-A3B9-853BAB1E0CD4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF5C1C76-D1A6-4E22-AE50-8AE587F83AAE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "594EE4E3-9618-4E3C-8278-7782034184F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.8.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "607FF56D-EB06-434B-925F-D83763F4555B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.8.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEC9286A-9537-4F18-8C73-61DE4506583B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.8.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "4711358C-B12B-4B48-9AF8-49C8298BA451",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de recorrido de directorio absoluto en steps/mail/sendmail.inc en Roundcube Webmail anterior a 0.7.3 y 0.8.x anterior a 0.8.6 permite a atacantes remotos leer archivos arbitrarios a trav\u00e9s de una ruta completa en el par\u00e1metro _value para la configuraci\u00f3n generic_message_footer en una acci\u00f3n save-perf hacia index.php, tal y como se explot\u00f3 activamente en marzo de 2013."
    }
  ],
  "id": "CVE-2013-1904",
  "lastModified": "2026-06-16T23:52:22.230",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2014-02-08T00:55:05.957",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://habrahabr.ru/post/174423/"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://lists.roundcube.net/pipermail/dev/2013-March/022328.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2013/03/28/8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://habrahabr.ru/post/174423/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://lists.roundcube.net/pipermail/dev/2013-March/022328.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2013/03/28/8"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-XHJQ-9GFC-7X74

Vulnerability from github – Published: 2022-05-17 04:53 – Updated: 2025-04-11 04:18

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2013-1904"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-02-08T00:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.",
  "id": "GHSA-xhjq-9gfc-7x74",
  "modified": "2025-04-11T04:18:56Z",
  "published": "2022-05-17T04:53:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1904"
    },
    {
      "type": "WEB",
      "url": "http://habrahabr.ru/post/174423"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.roundcube.net/pipermail/dev/2013-March/022328.html"
    },
    {
      "type": "WEB",
      "url": "http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2013/03/28/8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2013-1904

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

Aliases

CVE-2013-1904

Aliases

CVE-2013-1904

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2013-1904",
    "description": "Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.",
    "id": "GSD-2013-1904",
    "references": [
      "https://www.suse.com/security/cve/CVE-2013-1904.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2013-1904"
      ],
      "details": "Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.",
      "id": "GSD-2013-1904",
      "modified": "2023-12-13T01:22:20.451277Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2013-1904",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://habrahabr.ru/post/174423/",
            "refsource": "MISC",
            "url": "http://habrahabr.ru/post/174423/"
          },
          {
            "name": "http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/",
            "refsource": "CONFIRM",
            "url": "http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/"
          },
          {
            "name": "[dev] 20130327 [RCD] zero day vulnerability (tested on v8.0 to 9.0)",
            "refsource": "MLIST",
            "url": "http://lists.roundcube.net/pipermail/dev/2013-March/022328.html"
          },
          {
            "name": "openSUSE-SU-2013:0671",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html"
          },
          {
            "name": "[oss-security] 20130328 Re: CVE Request -- roundcubemail: Local file inclusion  via web UI modification of certain config options",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2013/03/28/8"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.8.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.8.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "0.7.2",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.3:stable:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.1:20051021:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.1:20051007:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.5.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.5.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.2:stable:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.8.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.8.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.7.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.5.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.1:20050820:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.8.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.5.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.2.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.1:stable:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:0.1:20050811:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2013-1904"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-22"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20130328 Re: CVE Request -- roundcubemail: Local file inclusion  via web UI modification of certain config options",
              "refsource": "MLIST",
              "tags": [],
              "url": "http://www.openwall.com/lists/oss-security/2013/03/28/8"
            },
            {
              "name": "http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/",
              "refsource": "CONFIRM",
              "tags": [
                "Patch"
              ],
              "url": "http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/"
            },
            {
              "name": "[dev] 20130327 [RCD] zero day vulnerability (tested on v8.0 to 9.0)",
              "refsource": "MLIST",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://lists.roundcube.net/pipermail/dev/2013-March/022328.html"
            },
            {
              "name": "http://habrahabr.ru/post/174423/",
              "refsource": "MISC",
              "tags": [],
              "url": "http://habrahabr.ru/post/174423/"
            },
            {
              "name": "openSUSE-SU-2013:0671",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2014-02-10T15:44Z",
      "publishedDate": "2014-02-08T00:55Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2013-1904 (GCVE-0-2013-1904)

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: kevintel

Details

References

FKIE_CVE-2013-1904

GHSA-XHJQ-9GFC-7X74

GSD-2013-1904

Tags

Sightings

Nomenclature

Related by attack behaviour