{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-21T02:52:10.157","vulnerabilities":[{"cve":{"id":"CVE-2018-1000072","sourceIdentifier":"cve@mitre.org","published":"2018-03-13T15:29:00.377","lastModified":"2026-06-17T01:32:21.537","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in Beta: 0.9.8-BETA1, Stable: 0.9.7."},{"lang":"es","value":"iRedMail, en versiones anteriores al commit con ID f04b8ef, contiene una vulnerabilidad de permisos inseguros en Roundcube Webmail que puede resultar en el filtrado del archivo protegido por contraseña de claves GPG secretas del usuario, así como otros archivos importantes de configuración. Este ataque parece ser explotable mediante conectividad de red. La vulnerabilidad parece haber sido solucionada en Beta:. 0.9.8-BETA1 y Stable: 0.9.7."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-732"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:iredmail:iredmail:*:*:*:*:*:*:*:*","versionEndIncluding":"0.9.6","matchCriteriaId":"6C2ED0B8-F170-4804-91C2-459756405553"}]}]}],"references":[{"url":"http://legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt","source":"cve@mitre.org","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://bitbucket.org/zhb/iredmail/issues/130/multiple-security-issues-with-default","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"http://legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://bitbucket.org/zhb/iredmail/issues/130/multiple-security-issues-with-default","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}}]}