« Volver al listado

CVE-2011-1491

Estado: ModificadaBaja (3.5)—

The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then compose an e-mail message, related to a "login CSRF" issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Roundcube — Webmail

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-1491",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-04-08T15:17:28.400",
  "references": [
    {
      "url": "http://openwall.com/lists/oss-security/2011/03/24/3",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2011/03/24/4",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2011/04/04/50",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://trac.roundcube.net/changeset/4490",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://trac.roundcube.net/wiki/Changelog",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66815",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2011/03/24/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2011/03/24/4",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2011/04/04/50",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://trac.roundcube.net/changeset/4490",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://trac.roundcube.net/wiki/Changelog",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66815",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then compose an e-mail message, related to a \"login CSRF\" issue."
    },
    {
      "lang": "es",
      "value": "El formulario de login en Roundcube Webmail anterior a v0.5.1 no maneja correctamente un intento de login no intencionado, lo que hace más fácil para  usuarios remotos autenticados de obtener información sensible haciendo que  una víctima haga login en la cuenta del atacante para luego componer un e-mail, relacionado con un problema de \"login CSRF\"."
    }
  ],
  "lastModified": "2026-06-16T23:29:29.157",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2E961628-4624-4095-8CE6-698F66BF462B",
              "versionEndIncluding": "0.5"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F433741-5F73-43B5-A522-C484C64C66A7"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09DF755B-041E-4A61-BEF6-A613F6F0CE13"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34D20437-7DE7-4DB8-8C11-37B09A87E3A4"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55FB4AA3-3528-46B7-BBB9-9185DAA5425C"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "066AA2BC-95A8-43E8-A1FE-9F15860691E1"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82FB886B-35A4-4A8C-AE18-62C845886018"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB6449FD-C6EE-497C-BE34-88900883AD09"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0CEF8BF6-E09F-4376-B089-9B722A84F591"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "946B0B6A-46D3-46B9-BD1E-B03D3339EEB3"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4D6EA96-EE58-47C3-B545-7238B3F64941"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3584BB62-818D-4A5B-BC7D-EAB0B85614EA"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "332FF744-3682-4818-9602-8F868BF0781E"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B502047-4DDD-4586-978C-6CEE1C41F923"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43581564-48CF-410C-9CE1-CBAE71153DA5"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A5CC548-05E4-4059-8252-FA78ECBB95A0"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3FA495A-D7FE-4461-AF57-EB649A1C49B6"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D773E61-113A-4EE8-804E-0584B73AB58D"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC0D4825-F78E-40F5-A9CB-45B73DE8FBD4"
            },
            {
              "criteria": "cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C8376B9-4DF2-4E23-9C43-EEDE3D800519"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}