High severity · published May 23, 2017
CVE-2015-5383
Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory
7.5
CVSS
3.8%
EPSS
No
On KEV
Description
Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.8% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RW
Roundcube Webmail · Roundcube
1.1.1 · source: NVD
WE
Webmail · Roundcube
1.1; 1.1; 1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5383
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5383
Mailing List
http://www.openwall.com/lists/oss-security/2015/07/07/2
Issue Tracking
https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39
Issue Tracking
https://github.com/roundcube/roundcubemail/issues/4816
Patch
https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released
More from Roundcube Webmail
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2020-12641
Roundcube Webmail Remote Code Execution Vulnerability
7.8
CVE-2017-16651
Roundcube Webmail File Disclosure Vulnerability
6.1
CVE-2020-35730
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
7.5
CVE-2015-8770
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated…