CVE-2021-44026 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitre	CNA	---				---
CVE	ADP	---				---
CISA-ADP	ADP	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 98%

Vendor	Product	Version
roundcube	webmail	𝑥 < 1.3.17
roundcube	webmail	1.4.0 ≤ 𝑥 < 1.4.12
debian	debian_linux	9.0
debian	debian_linux	10.0
debian	debian_linux	11.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

roundcube

bullseye (security)	1.4.15+dfsg.1-1+deb11u4 fixed
bullseye	1.4.15+dfsg.1-1+deb11u4 fixed
bookworm	1.6.5+dfsg-1+deb12u4 fixed
bookworm (security)	1.6.5+dfsg-1+deb12u4 fixed
sid	1.6.9+dfsg-1 fixed
trixie	1.6.9+dfsg-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

roundcube

noble	not-affected
mantic	not-affected
lunar	not-affected
kinetic	not-affected
jammy	not-affected
impish	ignored
hirsute	ignored
focal	Fixed 1.4.3+dfsg.1-1ubuntu0.1~esm2 released
bionic	Fixed 1.3.6+dfsg.1-1ubuntu0.1~esm2 released
xenial	Fixed 1.2~beta+dfsg.1-0ubuntu1+esm2 released
trusty	dne

Common Weakness Enumeration

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Vulnerability Media Exposure

[ENGLISH] Russian Hackers Exploit Email and VPN Vulnerabilities to Spy on Ukraine Aid Logistics
Russian cyber threat actors have been attributed to a state-sponsored campaign targeting Western logistics entities and technology companies since 2022. The activity has been assessed to be orchestrated by APT28 (aka BlueDelta, Fancy Bear, or Forest Blizzard), which is linked to the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center, Military Unit 26165.
Published: 2025-05-21T23:36:00+05:30

References

https://bugs.debian.org/1000156

https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1

https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa

https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/

https://www.debian.org/security/2021/dsa-5013

https://bugs.debian.org/1000156

https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1

https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa

https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/

https://www.debian.org/security/2021/dsa-5013