NVD

Id
28825  
Name
CVE-2015-8770  
Description
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.  
Reject
 
CVSS Version
2  
CVSS Score
6  
Severity
Medium  
CVSS Base Score
6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-01-29  
Modified Date
2016-12-05  
Seq
2015-8770  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
151767 28825 CVE-2015-8770 openSUSE-SU-2016:0210  View
151768 28825 CVE-2015-8770 openSUSE-SU-2016:0213  View
151769 28825 CVE-2015-8770 openSUSE-SU-2016:0214  View
151770 28825 CVE-2015-8770 http://packetstormsecurity.com/files/135274/Roundcube-1.1.3-Path-Traversal.html  View
151771 28825 CVE-2015-8770 http://trac.roundcube.net/changeset/10e5192a2b/github  View
151772 28825 CVE-2015-8770 http://trac.roundcube.net/ticket/1490620  View
151773 28825 CVE-2015-8770 DSA-3541  View
151774 28825 CVE-2015-8770 20160113 Remote Code Execution in Roundcube  View
151775 28825 CVE-2015-8770 https://roundcube.net/news/2015/12/26/updates-1.1.4-and-1.0.8-released/  View
151776 28825 CVE-2015-8770 GLSA-201603-03  View
151777 28825 CVE-2015-8770 https://www.htbridge.com/advisory/HTB23283  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
11566 JVNDB-2015-006886 Roundcube の program/include/rcmail_output_html.php の set_skin 関数におけるディレクトリトラバーサルの脆弱性 Roundcube の program/include/rcmail_output_html.php の set_skin 関数には、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2015-8770 85995 CVE-2015-8770 28825 6 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-006886.html 2015-12-26 2016-02-24 View