CVE-2021-44026 Roundcube Webmail SQL Injection
Attackers can execute arbitrary SQL commands via search parameters in Roundcube webmail, potentially accessing or modifying database contents.
- Exploited in the wild
- Since 22 Jun 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-44026?
CVE-2021-44026 is a critical SQL injection vulnerability in Debian Debian Linux, published on 19 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
Weakness: CWE-89
Which versions are affected by CVE-2021-44026?
1 open source package ship an affected version, including roundcube. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
roundcube Bitnami | All versions | 1.3.17, 1.4.12 |
Products include Debian Debian Linux, Fedoraproject Fedora, Roundcube Webmail.
How do I fix CVE-2021-44026?
Upgrade roundcube to a fixed version for your release line: 1.3.17 or 1.4.12. US federal agencies must fix it by 13 Jul 2023.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2021-44026 being exploited?
Yes. Attackers have exploited CVE-2021-44026 in the wild since at least 22 Jun 2023.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-roundcube-2021-44026, DEBIAN-CVE-2021-44026, GHSA-5fmq-jmc8-85rw, UBUNTU-CVE-2021-44026.