NVD Vulnerability Detail

CVE-2016-4069

Summary	Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors.
Publication Date	Aug. 26, 2016, 3:59 a.m.
Registration Date	Jan. 26, 2021, 2:11 p.m.
Last Update	Nov. 21, 2024, 11:51 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:opensuse:leap:42.1:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:roundcube:webmail::::::::			1.1.4

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html	Third Party Advisory
2	http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html	Third Party Advisory
3	http://www.openwall.com/lists/oss-security/2016/04/23/4	Mailing List Third Party Advisory
4	http://www.openwall.com/lists/oss-security/2016/04/23/4	Mailing List Third Party Advisory
5	http://www.securityfocus.com/bid/92654
6	http://www.securityfocus.com/bid/92654
7	https://github.com/roundcube/roundcubemail/commit/4a408843b0ef816daf70a472a02b78cd6073a4d5	Issue Tracking Patch
8	https://github.com/roundcube/roundcubemail/commit/4a408843b0ef816daf70a472a02b78cd6073a4d5	Issue Tracking Patch
9	https://github.com/roundcube/roundcubemail/commit/699af1e5206ed9114322adaa3c25c1c969640a53	Issue Tracking Patch
10	https://github.com/roundcube/roundcubemail/commit/699af1e5206ed9114322adaa3c25c1c969640a53	Issue Tracking Patch
11	https://github.com/roundcube/roundcubemail/issues/4957	Issue Tracking Mailing List
12	https://github.com/roundcube/roundcubemail/issues/4957	Issue Tracking Mailing List
13	https://github.com/roundcube/roundcubemail/releases/tag/1.1.5	Release Notes
14	https://github.com/roundcube/roundcubemail/releases/tag/1.1.5	Release Notes
15	https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115	Release Notes
16	https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115	Release Notes

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-352	クロスサイト・リクエスト・フォージェリ（CSRF）	https://cwe.mitre.org/data/definitions/352.html
2	CWE-352	同一生成元ポリシー違反	https://cwe.mitre.org/data/definitions/346.html

JVN Vulnerability Information

Roundcube Webmail におけるクロスサイトリクエストフォージェリの脆弱性

Title	Roundcube Webmail におけるクロスサイトリクエストフォージェリの脆弱性
Summary	Roundcube Webmail には、クロスサイトリクエストフォージェリの脆弱性が存在します。
Possible impacts	第三者により、ユーザの認証をハイジャックされ、アタッチメントをダウンロードされ、サービス運用妨害 (ディスクの消費) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 20, 2016, midnight
Registration Date	Aug. 29, 2016, 12:27 p.m.
Last Update	Aug. 29, 2016, 12:27 p.m.

Affected System

Roundcube.net

Roundcube 1.1.5 未満

openSUSE project

openSUSE Leap 42.1

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-4069	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4069
National Vulnerability Database (NVD)
2	CVE-2016-4069	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4069

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-352	https://jvndb.jvn.jp/ja/cwe/CWE-352.html

ベンダー情報

No	Name	URL
GitHub
1	CHANGELOG	https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115
2	Protect attachment downloads against CSRF #4957	https://github.com/roundcube/roundcubemail/issues/4957
3	Protect download urls against CSRF using unique request tokens (4a40884)	https://github.com/roundcube/roundcubemail/commit/4a408843b0ef816daf70a472a02b78cd6073a4d5
4	Protect download urls against CSRF using unique request tokens (699af1e)	https://github.com/roundcube/roundcubemail/commit/699af1e5206ed9114322adaa3c25c1c969640a53
5	Roundcube Webmail 1.1.5	https://github.com/roundcube/roundcubemail/releases/tag/1.1.5
opensuse-updates
6	openSUSE-SU-2016:2109	https://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html

Change Log

No	Changed Details	Date of change
0	[2016年08月29日] 掲載	Feb. 17, 2018, 10:37 a.m.