CVE-2016-4069 Vulnerability

Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors. (CVSS:6.8) (Last Update:2016-08-26)

Vulnerability Details : Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors. Publish Date : 2016-08-25 Last Update Date : 2016-08-26 - CVSS Scores & Vulnerability Types CVSS Score 6.8 Confidentiality Impact Partial(There is considerable informational disclosure.) Integrity Impact Partial(Modification of some system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is limited.) Availability Impact Partial(There is reduced performance or interruptions in resource availability.) Access Complexity Medium(The access conditions are somewhat specialized. Some preconditions must be satistified to exploit) Authentication Not required(Authentication is not required to exploit the vulnerability.) Gained Access None Vulnerability Type(s) Denial Of ServiceCSRF CWE ID 352 - Products Affected By CVE-2016-4069 # Product Type Vendor Product Version Update Edition Language 1 OS Novell Leap 42.1 Version Details Vulnerabilities 2 Application Roundcube Webmail 1.1.4 Version Details Vulnerabilities - Number Of Affected Versions By Product Vendor Product Vulnerable Versions Novell Leap 1 Roundcube Webmail 1 - References For CVE-2016-4069 http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html SUSE openSUSE-SU-2016:2109 http://www.openwall.com/lists/oss-security/2016/04/23/4 MLIST [oss-security] 20160423 Re: CVE Request: Roundcube: XSS issue in SVG image handling and protection for download urs against CSRF https://github.com/roundcube/roundcubemail/commit/4a408843b0ef816daf70a472a02b78cd6073a4d5 CONFIRM https://github.com/roundcube/roundcubemail/commit/699af1e5206ed9114322adaa3c25c1c969640a53 CONFIRM https://github.com/roundcube/roundcubemail/issues/4957 CONFIRM https://github.com/roundcube/roundcubemail/releases/tag/1.1.5 CONFIRM https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115 CONFIRM

- Metasploit Modules Related To CVE-2016-4069 There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information)