Debian Security Bug TrackerDEBIANCVE:CVE-2011-1492CVE-2011-1492
5.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:P/A:N
0.002 Low
EPSS
Percentile
58.4%
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | roundcube | < 0.5.1-1 | roundcube_0.5.1-1_all.deb |
| Debian | 11 | all | roundcube | < 0.5.1-1 | roundcube_0.5.1-1_all.deb |
| Debian | 10 | all | roundcube | < 0.5.1-1 | roundcube_0.5.1-1_all.deb |
| Debian | 999 | all | roundcube | < 0.5.1-1 | roundcube_0.5.1-1_all.deb |
| Debian | 13 | all | roundcube | < 0.5.1-1 | roundcube_0.5.1-1_all.deb |
Related
5.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:P/A:N
0.002 Low
EPSS
Percentile
58.4%