CVE-2017-16651

CVE Published	2017-11-09
Related CWE(s)	CWE-552: Files or Directories Accessible to External Parties
Related Vendor(s)	roundcube, debian
Related Product(s)	webmail, debian_linux
Exploitation Reported (CISA KEV)	2021-11-03
CVSS 3 Base Score	7.8 (HIGH)
CVSS 3 Attack Complexity	LOW
CVSS 3 Attack Vector	LOCAL

Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.

Cyber Threat Graph Context

Explore how this CVE relates to the wider threat graph

Associated CAPEC Patterns

Collect Data from Common Resource Locations (CAPEC-150)

An adversary exploits well-known locations for resources for the purposes of undermining the security of the target. In many, if not most systems, files and resources are organized in a default tree structure. This can be useful for adversaries because they often know where to look for resources or files that are necessary for attacks. Even when the precise location of a targeted resource may not be known, naming conventions may indicate a small area of the target machine's file tree where the resources are typically located. For example, configuration files are normally stored in the /etc director on Unix systems. Adversaries can take advantage of this to commit other types of attacks.

Probe System Files (CAPEC-639)

An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.

References

CVE-2017-16651

Cyber Threat Graph Context

Associated CAPEC Patterns

Collect Data from Common Resource Locations (CAPEC-150)

Probe System Files (CAPEC-639)

References

CVE.org

NIST National Vulnerability Database

CISA Known Exploited Vulnerabilities