VYPR
Get started
← All advisories
Unrated severityNVD Advisory· Published Feb 8, 2014· Updated Apr 29, 2026

CVE-2013-1904

CVE-2013-1904

Description

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.

Affected products

44
  • Roundcube/Webmail44 versions
    cpe:2.3:a:roundcube:webmail:0.8.5:*:*:*:*:*:*:*+ 43 more
    • cpe:2.3:a:roundcube:webmail:0.8.5:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*range: <=0.7.2
    • cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.1:20050811:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.1:20050820:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.1:20051007:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.1:20051021:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.1:stable:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.2:stable:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.3:stable:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.5.3:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.5.4:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.8.0:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.8.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.8.2:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.8.3:*:*:*:*:*:*:*
    • cpe:2.3:a:roundcube:webmail:0.8.4:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.