PatchSiren

PatchSiren cyber security CVE debrief

CVE-2015-2180 Roundcube CVE debrief

CVE-2015-2180 affects Roundcube webmail before 1.1.0, specifically the Password plugin’s DBMail driver. The CVE description and NVD record state that shell metacharacters in the password can be used to execute arbitrary commands. NVD rates the issue as network-accessible with low attack complexity, low privileges required, no user interaction, and high impact to confidentiality, integrity, and availability.

Vendor
Roundcube
Product
Webmail
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-30
Original CVE updated
2026-05-13
Advisory published
2017-01-30
Advisory updated
2026-05-13

Who should care

Roundcube administrators, especially environments that enable the Password plugin and DBMail driver, plus security teams responsible for webmail services.

Technical summary

The NVD record maps this issue to Roundcube webmail versions through 1.1 and assigns CWE-74. Its CVSS v3.0 vector is CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a remotely reachable flaw that can be exercised with relatively low effort once an attacker can supply a crafted password value to the affected plugin path. The vulnerable component is the Password plugin’s DBMail driver, and the problem is command execution triggered by shell metacharacters.

Defensive priority

High — prioritize upgrading Roundcube to a fixed release, especially where the Password plugin/DBMail driver is enabled, and validate that no exposed workflow still accepts untrusted password input into shell-backed processing.

Recommended defensive actions

  • Upgrade Roundcube to 1.1.0 or later, or the vendor-fixed release used in your environment.
  • Inventory whether the Password plugin and DBMail driver are enabled anywhere in production.
  • Review logs and operational telemetry for anomalous password-change activity or unexpected command execution indicators.
  • Restrict exposure of administrative or password-management functions to trusted users and networks where possible.
  • Reassess webmail hardening controls, including least privilege for the application runtime and any downstream command invocations.

Evidence notes

The debrief is based on the official CVE/NVD record and the references listed there. NVD shows the affected CPE as Roundcube webmail through 1.1, assigns CVSS v3.0 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and labels the weakness CWE-74. NVD also lists the Roundcube GitHub issue 4757 as an Exploit/Vendor Advisory reference and SecurityFocus BID 96387 as an additional reference.

Sources and references

Verified primary and authoritative sources

  • CVE-2015-2180 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2015-2180

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2015-2180 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2015-2180

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.