Lucene search

[email protected]NVD:CVE-2011-1492

HistoryApr 08, 2011 - 3:17 p.m.

CVE-2011-1492

2011-04-0815:17:28

CWE-20

[email protected]

web.nvd.nist.gov

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

AI Score

6.2

Confidence

Low

EPSS

0.002

Percentile

58.9%

JSON

steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request.

Affected configurations

Nvd

Node

roundcubewebmailRange≤0.5

roundcubewebmailMatch0.1

roundcubewebmailMatch0.1alpha

roundcubewebmailMatch0.1beta

roundcubewebmailMatch0.1beta2

roundcubewebmailMatch0.1rc1

roundcubewebmailMatch0.1rc2

roundcubewebmailMatch0.1.1

roundcubewebmailMatch0.2

roundcubewebmailMatch0.2alpha

roundcubewebmailMatch0.2beta

roundcubewebmailMatch0.2.1

roundcubewebmailMatch0.3

roundcubewebmailMatch0.3beta

roundcubewebmailMatch0.3rc1

roundcubewebmailMatch0.3.1

roundcubewebmailMatch0.4

roundcubewebmailMatch0.4beta

roundcubewebmailMatch0.4.1

roundcubewebmailMatch0.4.2

roundcubewebmailMatch0.5beta

roundcubewebmailMatch0.5rc

VendorProductVersionCPE
roundcubewebmail*cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
roundcubewebmail0.1cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*
roundcubewebmail0.1cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*
roundcubewebmail0.1cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*
roundcubewebmail0.1cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*
roundcubewebmail0.1cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*
roundcubewebmail0.1cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*
roundcubewebmail0.1.1cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*
roundcubewebmail0.2cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*
roundcubewebmail0.2cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*

Vendor	Product	Version	CPE
roundcube	webmail	*	cpe:2.3:a:roundcube:webmail::::::::
roundcube	webmail	0.1	cpe:2.3:a:roundcube:webmail:0.1:::::::*
roundcube	webmail	0.1	cpe:2.3:a:roundcube:webmail:0.1:alpha::::::
roundcube	webmail	0.1	cpe:2.3:a:roundcube:webmail:0.1:beta::::::
roundcube	webmail	0.1	cpe:2.3:a:roundcube:webmail:0.1:beta2::::::
roundcube	webmail	0.1	cpe:2.3:a:roundcube:webmail:0.1:rc1::::::
roundcube	webmail	0.1	cpe:2.3:a:roundcube:webmail:0.1:rc2::::::
roundcube	webmail	0.1.1	cpe:2.3:a:roundcube:webmail:0.1.1:::::::*
roundcube	webmail	0.2	cpe:2.3:a:roundcube:webmail:0.2:::::::*
roundcube	webmail	0.2	cpe:2.3:a:roundcube:webmail:0.2:alpha::::::