roundcube -- XSS vulnerability

2011-08-09T00:00:00
ID 4AE68E7C-DDA4-11E0-A906-00215C6A37BB
Type freebsd
Reporter FreeBSD
Modified 2011-08-09T00:00:00

Description

RoundCube development Team reports:

We just published a new release which fixes a recently reported XSS vulnerability as an update to the stable 0.5 branch. Please update your installations with this new version or patch them with the fix which is also published in the downloads section or our sourceforge.net page.

and:

During one of pen-tests I found that _mbox parameter is not properly sanitized and reflected XSS attack is possible.