CyberRota Analysis
AI-GeneratedThe cmd_learn driver of the markasjunk plugin in Roundcube Webmail versions prior to 1.6.18 and 1.7.3 is vulnerable to remote code execution due to improper handling of crafted placeholder replacement values. This vulnerability poses a significant risk to any Roundcube instances utilizing the markasjunk plugin, allowing attackers to execute arbitrary code remotely. Organizations using affected versions of Roundcube should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver.
Related CVEs
Other vulnerabilities affecting the same vendor(s)