CVE-2016-9920

State: Published
Severity: Not scored
Published: Dec 8, 2016
Updated: Aug 6, 2024
Reserved: Dec 8, 2016

Description

steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://blog.ripstech.com/2016/roundcube-command-execution-via-email/
94858vdb-entry
[oss-security] 20161208 roundcube code execution via mail()mailing-list
https://roundcube.net/news/2016/11/28/updates-1.2.3-and-1.1.7-released
GLSA-201612-44vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.