Roundcube Webmail Flaws Allow Hackers to Steal Emails and Passwords

Submitted ⁨⁨3⁩ ⁨months⁩ ago⁩ by ⁨atzanteol@sh.itjust.works⁩ to ⁨selfhosted@lemmy.world⁩

If you’re self hosting roundcube be sure to update.

Comments

Sort:hotnew top

cheddar@programming.dev ⁨3⁩ ⁨months⁩ ago
I’m not surprised. A cube can’t be round. That’s an obvious design flaw.

source
shadowbert@lemmy.world ⁨2⁩ ⁨months⁩ ago
It’s only if you view a specifically crafted email in the web client… still worth upgrading of course.

source
- atzanteol@sh.itjust.works ⁨2⁩ ⁨months⁩ ago
  Only? “Viewing emails in a web browser” is the entire point of roundcube. It’s trivial to send out millions of “specially created emails” looking for a victim.
  
  source
  - shadowbert@lemmy.world ⁨2⁩ ⁨months⁩ ago
    True, but it presumably would still require the user to open them.
    
    But, I was mostly worried that just having the server installed would be enough.
    
    source