CVE-2015-2180: roundcube webmail Injection
CVSS: 9.0v2.0HighModified
AliasesUBUNTU-CVE-2015-2180DEBIAN-CVE-2015-2180
Published 30-01-2017Last modified 06-08-2024
Vulnerability summary
CVE-2015-2180 is a high (CVSS 9.0) Injection vulnerability in roundcube webmail. EPSS estimates a 4.71% chance of exploitation in the next 30 days, higher than 91.7% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.0/10
010
High · v2.0 (NVD)EPSS score
4.71%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 30-01-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
High 9.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
4.71%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 4.71% on 20-09-2026
20-09-202620-10-2026
EPSS score4.71%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundRoundcubemail
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian1 product
- roundcube< 1.1.1+dfsg.1-2
Roundcube1 product
- webmail≤ 1.1
Ubuntu1 product
- roundcube< 1.3.6+dfsg.1-1
3 vendors · 3 products
