roundcube -- XSS vulnerability

ID 4AE68E7C-DDA4-11E0-A906-00215C6A37BB
Type freebsd
Reporter FreeBSD
Modified 2011-08-09T00:00:00


RoundCube development Team reports:

We just published a new release which fixes a recently reported XSS vulnerability as an update to the stable 0.5 branch. Please update your installations with this new version or patch them with the fix which is also published in the downloads section or our page.


During one of pen-tests I found that _mbox parameter is not properly sanitized and reflected XSS attack is possible.