Actively exploited · Published Nov 19, 2021 · Assigned by mitre
CVE-2021-44026
Critical 9.8 Exploited
In plain English
A critical-severity SQL injection in Roundcube Webmail from Roundcube. Attackers are actively exploiting it in the wild (listed by CISA on June 22, 2023). The chance it is exploited in the next 30 days is estimated at 69.9% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jul 13, 2023.
Official description
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | roundcube | 1.5.0+dfsg.1-1 | DEBIAN-CVE-2021-44026 |
| Debian:13 | roundcube | 1.5.0+dfsg.1-1 | DEBIAN-CVE-2021-44026 |
| Debian:14 | roundcube | 1.5.0+dfsg.1-1 | DEBIAN-CVE-2021-44026 |
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://bugs.debian.org/1000156 x_refsource_MISC
- https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1 x_refsource_MISC
- https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa x_refsource_MISC
- FEDORA-2021-167865df98 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-43d3c10590 vendor-advisory, x_refsource_FEDORA
- DSA-5013 vendor-advisory, x_refsource_DEBIAN
- [debian-lts-announce] 20211206 [SECURITY] [DLA 2840-1] roundcube security update mailing-list, x_refsource_MLIST
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44026 government-resource