CVE-2015-5383: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2017-05-23T04:29Z
Repository: https://github.com/roundcube/roundcubemail
Language: Other
Files changed: INSTALL, config/.htaccess, logs/.htaccess, temp/.htaccess
Commit date: 2015-05-07 11:00:35 +0200
Commit message: Add .htaccess files to deny access to config, temp, logs + describe how to protect access to these directories in the INSTALL instructions (#1490378)

Diff: diff --git a/INSTALL b/INSTALL
index 67c0c05c2..0087a4106 100644
--- a/INSTALL
+++ b/INSTALL
@@ -151,10 +151,27 @@ guidance.
 You can also modify the default .htaccess file. This is necessary to
 increase the allowed size of file attachments, for example:
 	php_value       upload_max_filesize     2M
 
 
+SECURE YOUR INSTALLATION
+========================
+
+Access through the webserver to the following directories should be denied:
+
+  /config
+  /temp
+  /logs
+
+Roundcube uses .htaccess files to protect these directories, so be sure to
+allow override of the Limit directives to get them taken into account. The
+package also ships a .htaccess file in the root directory which defines some
+rewrite rules. In order to properly secure your installation, please enable
+mod_rewrite for Apache webserver and double check access to the above listed
+directories and their contents is denied.
+
+
 UPGRADING
 =========
 
 If you already have a previous version of Roundcube installed,
 please refer to the instructions in UPGRADING guide.
diff --git a/config/.htaccess b/config/.htaccess
new file mode 100644
index 000000000..896e680ba
--- /dev/null
+++ b/config/.htaccess
@@ -0,0 +1,2 @@
+# deny webserver access to this directory
+Deny from all
diff --git a/logs/.htaccess b/logs/.htaccess
new file mode 100644
index 000000000..896e680ba
--- /dev/null
+++ b/logs/.htaccess
@@ -0,0 +1,2 @@
+# deny webserver access to this directory
+Deny from all
diff --git a/temp/.htaccess b/temp/.htaccess
new file mode 100644
index 000000000..896e680ba
--- /dev/null
+++ b/temp/.htaccess
@@ -0,0 +1,2 @@
+# deny webserver access to this directory
+Deny from all

Fixed code: SECURE YOUR INSTALLATION
========================

Access through the webserver to the following directories should be denied:

  /config
  /temp
  /logs

Roundcube uses .htaccess files to protect these directories, so be sure to
allow override of the Limit directives to get them taken into account. The
package also ships a .htaccess file in the root directory which defines some
rewrite rules. In order to properly secure your installation, please enable
mod_rewrite for Apache webserver and double check access to the above listed
directories and their contents is denied.


# deny webserver access to this directory
Deny from all
# deny webserver access to this directory
Deny from all
# deny webserver access to this directory
Deny from all