PRIVATE_FEEDS/CVE_VULN_FEED/CVE-2020-12640-roundcube_rce/alert_text.md

Date: 2020-09-25

Roundcube Webmail before 1.4.4 allows unauth-attackers to execute arbitrary code via shell metacharacter (CVE-2020-12641)

Roundcube Webmail before 1.4.4 allows unauth-attackers to include local files and execute code via directory traversal in a plugin name to rcube plugin api.php. (CVE-2020-12640)

CVE : CVE-2020-12640 / CVE-2020-12641 Vendor : Roundcube Product : Webmail CPE : BaseScore : 9.8 Vector : Network

Patches : available Exploits : unknown

we found various IPs in your ORG/ASN, matching criteria for possible vulnerable systems

False-Positive-Level:

please find a list of affected IPs below and more information on that problem here:

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2020-12641
• NIST: https://nvd.nist.gov/vuln/detail/CVE-2020-12640