CVE-2015-8105

2015-11-1017:59:13

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.002

Percentile

52.0%

JSON

Cross-site scripting (XSS) vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload.

OSVersionArchitecturePackageVersionFilename
Debian12allroundcube< 1.1.3+dfsg.1-1roundcube_1.1.3+dfsg.1-1_all.deb
Debian11allroundcube< 1.1.3+dfsg.1-1roundcube_1.1.3+dfsg.1-1_all.deb
Debian999allroundcube< 1.1.3+dfsg.1-1roundcube_1.1.3+dfsg.1-1_all.deb
Debian13allroundcube< 1.1.3+dfsg.1-1roundcube_1.1.3+dfsg.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	roundcube	< 1.1.3+dfsg.1-1	roundcube_1.1.3+dfsg.1-1_all.deb
Debian	11	all	roundcube	< 1.1.3+dfsg.1-1	roundcube_1.1.3+dfsg.1-1_all.deb
Debian	999	all	roundcube	< 1.1.3+dfsg.1-1	roundcube_1.1.3+dfsg.1-1_all.deb
Debian	13	all	roundcube	< 1.1.3+dfsg.1-1	roundcube_1.1.3+dfsg.1-1_all.deb