CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: Jul 13, 2023

High

CISA KEV

CVE-2020-12641

Roundcube—Roundcube Webmail

Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

Required Action

https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10; https://nvd.nist.gov/vuln/detail/CVE-2020-12641

Vulnerability Overview

Severity: High
CISA KEV: Yes
Ransomware: Unknown
Published: Jun 22, 2023
KEV Added: Jun 22, 2023
Due Date: Jul 13, 2023
Related Articles: 0

Vendor

Roundcube

Roundcube Webmail