Description

roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.

Remediation

References

CVE-2018-1000071

Related Vulnerabilities

WordPress Plugin Pay With Tweet SQL Injection and Cross-Site Scripting Vulnerabilities (1.1)

WordPress Plugin Authorize.net Payment Gateway For WooCommerce Security Bypass (2.0)

WordPress Plugin Arigato Autoresponder and Newsletter Remote Code Execution (2.5.1.9)

Joomla! Core 1.7.x Cross-Site Scripting (1.7.0 - 1.7.3)

PHP Other Vulnerability (CVE-2015-1352)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities CVE-2018-1000071