What’s Vulnerable › Vulnerabilities

CVE-2018-1000072

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-03-13 · updated 2026-06-17
• Weakness: CWE-732

Description

iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in Beta: 0.9.8-BETA1, Stable: 0.9.7.

Affected products

• Iredmail: through 0.9.6

References

• http://legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt
• https://bitbucket.org/zhb/iredmail/issues/130/multiple-security-issues-with-default
• http://legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt
• https://bitbucket.org/zhb/iredmail/issues/130/multiple-security-issues-with-default

Get alerted when CVE-2018-1000072 or the next vulnerability affects your stack