RCE in Roundcube Webmail
CVE-2008-5619
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 10.0 (High). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.586 (99.1th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.586 · newest: 0.586 · change: 0.000
Affected products
- Roundcube Webmail — versions 0.2.1, 0.2.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- mahara.org/interaction/forum/topic.php
- www.exploit-db.com/exploits/7549 (exploit)
- www.exploit-db.com/exploits/7553 (exploit)
- www.redhat.com/archives/fedora-package-announce/2008-December/msg00802.html (vendor-advisory)
- www.vupen.com/english/advisories/2008/3418 (vdb-entry)
- github.com/PHPMailer/PHPMailer/commit/8beacc646acb67c995aea10ac5585970efc7355a
- trac.roundcube.net/changeset/2148 (Exploit)
- osvdb.org/53893 (vdb-entry)
- sourceforge.net/forum/forum.php (Vendor Advisory)
- secunia.com/advisories/34789 (third-party-advisory)
Frequently asked questions
- What is CVE-2008-5619?
- CVE-2008-5619 is a vulnerability in Roundcube Webmail, classified under Code Injection. Published 2008-12-17.
- Is CVE-2008-5619 known to be exploited?
- 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.