CVE-2020-12640
Fixed in a distro release EPSS 7%
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.
Products: roundcube webmail, opensuse backports_sle, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | roundcube | 1.4.4+dfsg.1-1 |
| Debian 13 | roundcube | 1.4.4+dfsg.1-1 |
| Debian 14 | roundcube | 1.4.4+dfsg.1-1 |
| SUSE Package Hub 15 SP1 | roundcubemail | 1.3.15-bp152.4.3.1 |
| SUSE Package Hub 15 SP2 | roundcubemail | 1.3.15-bp152.4.3.1 |
| Ubuntu Pro 16.04 LTS | roundcube | 1.2~beta+dfsg.1-0ubuntu1+esm2 |
| Ubuntu Pro 18.04 LTS | roundcube | 1.3.6+dfsg.1-1ubuntu0.1~esm2 |
| Ubuntu Pro 20.04 LTS | roundcube | 1.4.3+dfsg.1-1ubuntu0.1~esm1 |
| Ubuntu Pro 20.04 LTS | roundcube | 1.4.3+dfsg.1-1ubuntu0.1~esm2 |
| Ubuntu Pro 22.04 LTS | roundcube | 1.5.0+dfsg.1-2ubuntu0.1~esm1 |
| openSUSE Leap 15.1 | roundcubemail | 1.3.15-bp152.4.3.1 |
| openSUSE Leap 15.2 | roundcubemail | 1.3.15-bp152.4.3.1 |