Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Roundcube Improper Access Control Vulnerability - CVE-2016-9920 - Vulnerability Database
Roundcube

Roundcube Improper Access Control Vulnerability - CVE-2016-9920

High
Reference: CVE-2016-9920
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2016-9920
Title: Roundcube Improper Access Control Vulnerability
Overview:

steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3 when no SMTP server is configured and the sendmail program is enabled does not properly restrict the use of custom envelope-from addresses on the sendmail command line which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.