QwikSec

Security Database

CVE

CWE

Training

CVE-2015-8770

Published: Jan 29, 2016

Modified: Aug 6, 2024

PUBLISHED

Description

Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

vendor-advisory

x_refsource_GENTOO

vendor-advisory

x_refsource_DEBIAN

http://trac.roundcube.net/changeset/10e5192a2b/github

x_refsource_CONFIRM

20160113 Remote Code Execution in Roundcube

mailing-list

x_refsource_BUGTRAQ

openSUSE-SU-2016:0214

vendor-advisory

x_refsource_SUSE

https://roundcube.net/news/2015/12/26/updates-1.1.4-and-1.0.8-released/

x_refsource_CONFIRM

openSUSE-SU-2016:0210

vendor-advisory

x_refsource_SUSE

http://trac.roundcube.net/ticket/1490620

x_refsource_CONFIRM

http://packetstormsecurity.com/files/135274/Roundcube-1.1.3-Path-Traversal.html

x_refsource_MISC

exploit

x_refsource_EXPLOIT-DB

https://www.htbridge.com/advisory/HTB23283

x_refsource_MISC

openSUSE-SU-2016:0213

vendor-advisory

x_refsource_SUSE

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.