Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Roundcube Unspesificed Vulnerability - CVE-2018-9846 - Vulnerability Database
Roundcube

Roundcube Unspesificed Vulnerability - CVE-2018-9846

High
Reference: CVE-2018-9846
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2018-9846
Title: Roundcube Unspesificed Vulnerability
Overview:

In Roundcube from versions 1.2.0 to 1.3.5 with the archive plugin enabled and configured it039s possible to exploit the unsanitized user-controlled quot_uidquot parameter (in an archive.php _taskmailamp_mboxINBOXamp_actionplugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a 0d0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.