CyberRota Analysis
AI-GeneratedThe modoboa driver of the password plugin in Roundcube Webmail versions prior to 1.6.18 and 1.7.x before 1.7.3 is vulnerable to a session data manipulation attack, which can lead to the leakage of a Modoboa API authentication token to an attacker-controlled host. This vulnerability poses a medium risk, as it could allow unauthorized access to sensitive data or services. Organizations using the affected versions of Roundcube with the password plugin should prioritize updating to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver.
Related CVEs
Other vulnerabilities affecting the same vendor(s)