Bugzilla – Bug 1089461
VUL-1: CVE-2018-9846: roundcubemail: MX injection in archive.php
Last modified: 2019-07-04 05:57:45 UTC
In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and
configured, it's possible to exploit the unsanitized, user-controlled "_uid"
parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive
request) to perform an MX (IMAP) injection attack by placing an IMAP command
after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and
later because of a Same Origin Policy protection mechanism.
42.3 is eol, 15.0 has 1.3.6... is resolved