What’s Vulnerable › Vulnerabilities

CVE-2016-4069

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-08-25 · updated 2026-06-17
• Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors.

Affected products

• openSUSE Leap: 42.1
• Roundcube Webmail: through 1.1.4

References

• http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html
• http://www.openwall.com/lists/oss-security/2016/04/23/4
• http://www.securityfocus.com/bid/92654
• https://github.com/roundcube/roundcubemail/commit/4a408843b0ef816daf70a472a02b78cd6073a4d5
• https://github.com/roundcube/roundcubemail/commit/699af1e5206ed9114322adaa3c25c1c969640a53
• https://github.com/roundcube/roundcubemail/issues/4957
• https://github.com/roundcube/roundcubemail/releases/tag/1.1.5
• https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html
• http://www.openwall.com/lists/oss-security/2016/04/23/4
• http://www.securityfocus.com/bid/92654
• https://github.com/roundcube/roundcubemail/commit/4a408843b0ef816daf70a472a02b78cd6073a4d5

Get alerted when CVE-2016-4069 or the next vulnerability affects your stack