Vulnerability Details : CVE-2018-1000071
Potential exploit
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.
Products affected by CVE-2018-1000071
- cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-1000071
0.93%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 83 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-1000071
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2018-1000071
-
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-1000071
-
https://github.com/roundcube/roundcubemail/issues/6173
Permissions issue with enigma plugin allows exfiltration of secret gpg key file · Issue #6173 · roundcube/roundcubemail · GitHubThird Party Advisory
-
https://www.legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt
Exploit;Third Party Advisory
Jump to