Unscored severity · published Jan 15, 2015
CVE-2014-9587
Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown…
–
CVSS
1.9%
EPSS
No
On KEV
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webmail · Roundcube
through 1.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-9587
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-9587
Patch
http://roundcube.net/news/2014/12/18/update-1.0.4-released/
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/01/11/3
www.securityfocus.com
http://www.securityfocus.com/bid/71909
bugs.gentoo.org
https://bugs.gentoo.org/show_bug.cgi?id=534766
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1179780
More from Webmail
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2020-12641
Roundcube Webmail Remote Code Execution Vulnerability
9.3
CVE-2024-42009
RoundCube Webmail Cross-Site Scripting Vulnerability
8.8
CVE-2025-49113
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
7.8
CVE-2017-16651
Roundcube Webmail File Disclosure Vulnerability