Actively exploited · Published May 4, 2020 · Assigned by mitre
CVE-2020-12641
Critical 9.8 Exploited
In plain English
A critical-severity OS command injection in Roundcube Webmail from Roundcube. Attackers are actively exploiting it in the wild (listed by CISA on June 22, 2023). The chance it is exploited in the next 30 days is estimated at 84.4% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jul 13, 2023.
Official description
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | roundcube | 1.4.4+dfsg.1-1 | DEBIAN-CVE-2020-12641 |
| Debian:13 | roundcube | 1.4.4+dfsg.1-1 | DEBIAN-CVE-2020-12641 |
| Debian:14 | roundcube | 1.4.4+dfsg.1-1 | DEBIAN-CVE-2020-12641 |
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.4 x_refsource_MISC
- https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4 x_refsource_MISC
- https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10 x_refsource_MISC
- https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3 x_refsource_MISC
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube x_refsource_MISC
- GLSA-202007-41 vendor-advisory, x_refsource_GENTOO
- openSUSE-SU-2020:1516 vendor-advisory, x_refsource_SUSE
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-12641 government-resource