Lucene search

FreeBSDC906E0A4-EFA6-11E1-8FBF-001B77D09812

HistoryAug 14, 2012 - 12:00 a.m.

roundcube -- cross-site scripting in HTML email messages

2012-08-1400:00:00

vuxml.freebsd.org

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.003

Percentile

66.3%

JSON

RoundCube branch 0.8.x prior to the version 0.8.1 is prone
to the cross-scripting attack (XSS) originating from incoming
HTML e-mails: due to the lack of proper sanitization
of JavaScript code inside the “href” attribute, sender
could launch XSS attack when recipient opens the message
in RoundCube interface.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchroundcube= 0.8.0,1UNKNOWN
FreeBSDanynoarchroundcube< 0.8.1,1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
FreeBSD	any	noarch	roundcube	= 0.8.0,1	UNKNOWN
FreeBSD	any	noarch	roundcube	< 0.8.1,1	UNKNOWN

References

trac.roundcube.net/ticket/1488613

trac.roundcube.net/wiki/Changelog

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.003

Percentile

66.3%

JSON

Related for C906E0A4-EFA6-11E1-8FBF-001B77D09812