Vulnerability in N/a
CVE-2020-12641
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
EPSS: 0.933 (99.8th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply updates per vendor instructions.
Public proof-of-concept exploits
References
- github.com/roundcube/roundcubemail/releases/tag/1.4.4 (x_refsource_MISC)
- github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4 (x_refsource_MISC)
- roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10 (x_refsource_MISC)
- github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364… (x_refsource_MISC)
- github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command Injecti… (x_refsource_MISC)
- GLSA-202007-41 (vendor-advisory, x_refsource_GENTOO)
- openSUSE-SU-2020:1516 (vendor-advisory, x_refsource_SUSE)
Frequently asked questions
- What is CVE-2020-12641?
- CVE-2020-12641 is a vulnerability in N/a. Published 2020-05-04.
- Is CVE-2020-12641 known to be exploited?
- Yes. CVE-2020-12641 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2023-06-22), indicating it is being actively exploited. 8 public proof-of-concept repositories are indexed.