Unrated severityNVD Advisory· Published Nov 5, 2013· Updated Apr 29, 2026
CVE-2013-6172
CVE-2013-6172
Description
steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code.
Affected products
54cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*+ 53 more
- cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*range: <=0.8.6
- cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.1:20050811:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.1:20050820:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.1:20051007:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.1:20051021:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.6:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.7:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.1:stable:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.2:stable:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.3:stable:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.8.5:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.9:beta:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.9:rc:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.9:rc2:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.9.3:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.9.4:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- roundcube.net/news/2013/10/21/security-updates-095-and-087/nvdPatchVendor Advisory
- trac.roundcube.net/ticket/1489382nvdPatch
- lists.opensuse.org/opensuse-updates/2014-03/msg00035.htmlnvd
- www.debian.org/security/2013/dsa-2787nvd
- www.interworx.com/developers/changelog/version-5-0-13-build-574-2014-02-19nvd
News mentions
0No linked articles in our index yet.