CyberSec.Space Logo
Back to CVE Browser

CVE-2021-44026

Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
EPSS Score29.2880%
EPSS Percentile92.70th
PublishedNov 19, 2021
Last ModifiedNov 4, 2025

Vulnerability Description

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

Affected Platforms (CPE)

📦
Roundcube

Webmail

< 1.3.17
📦
Roundcube

Webmail

>= 1.4.0 and < 1.4.12
💻
Fedoraproject

Fedora

= 33
💻
Fedoraproject

Fedora

= 34
💻
Debian

Debian Linux

= 9.0
💻
Debian

Debian Linux

= 10.0
💻
Debian

Debian Linux

= 11.0

References & Advisories

🔗 https://bugs.debian.org/1000156
🔗 https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1
🔗 https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa
🔗 https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/
🔗 https://www.debian.org/security/2021/dsa-5013
🔗 https://bugs.debian.org/1000156

Related Vulnerabilities

CVE-2001-095310.0

Kebi WebMail allows remote attackers to access the administrator menu and gain privileges via the /a/ hidden directory, which is i...

CVE-2003-120210.0

The checklogin function in omail.pl for omail webmail 0.98.4 and earlier allows remote attackers to execute arbitrary commands via...

CVE-2001-002110.0

MailMan Webmail 3.0.25 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the alternate...

CVE-2003-119210.0

Stack-based buffer overflow in IA WebMail Server 3.1.0 allows remote attackers to execute arbitrary code via a long GET request.