CVE-2017-8114

Published: 2017-04-29T19:59Z

Last Modified: 2024-11-21T03:33Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt