PatchSiren

PatchSiren cyber security CVE debrief

CVE-2015-2180 Roundcube CVE debrief

CVE-2015-2180 affects Roundcube webmail before 1.1.0, specifically the Password plugin’s DBMail driver. The CVE description and NVD record state that shell metacharacters in the password can be used to execute arbitrary commands. NVD rates the issue as network-accessible with low attack complexity, low privileges required, no user interaction, and high impact to confidentiality, integrity, and availability.

Vendor
Roundcube
Product
CVE-2015-2180
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-30
Original CVE updated
2026-05-13
Advisory published
2017-01-30
Advisory updated
2026-05-13

Who should care

Roundcube administrators, especially environments that enable the Password plugin and DBMail driver, plus security teams responsible for webmail services.

Technical summary

The NVD record maps this issue to Roundcube webmail versions through 1.1 and assigns CWE-74. Its CVSS v3.0 vector is CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a remotely reachable flaw that can be exercised with relatively low effort once an attacker can supply a crafted password value to the affected plugin path. The vulnerable component is the Password plugin’s DBMail driver, and the problem is command execution triggered by shell metacharacters.

Defensive priority

High — prioritize upgrading Roundcube to a fixed release, especially where the Password plugin/DBMail driver is enabled, and validate that no exposed workflow still accepts untrusted password input into shell-backed processing.

Recommended defensive actions

  • Upgrade Roundcube to 1.1.0 or later, or the vendor-fixed release used in your environment.
  • Inventory whether the Password plugin and DBMail driver are enabled anywhere in production.
  • Review logs and operational telemetry for anomalous password-change activity or unexpected command execution indicators.
  • Restrict exposure of administrative or password-management functions to trusted users and networks where possible.
  • Reassess webmail hardening controls, including least privilege for the application runtime and any downstream command invocations.

Evidence notes

The debrief is based on the official CVE/NVD record and the references listed there. NVD shows the affected CPE as Roundcube webmail through 1.1, assigns CVSS v3.0 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and labels the weakness CWE-74. NVD also lists the Roundcube GitHub issue 4757 as an Exploit/Vendor Advisory reference and SecurityFocus BID 96387 as an additional reference.

Official resources

Public CVE record published on 2017-01-30 and later modified on 2026-05-13; this debrief uses the published CVE/NVD record and linked references for timing and impact context.