cve/2017/CVE-2017-8114.md

CVE-2017-8114

Description

Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.

POC

Reference

• https://hackerone.com/reports/242119

Github

No PoCs found on GitHub currently.