Roundcube Webmail 0.1 CSS Expression Input Validation Vulnerability

ID SSV:84235
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00


No description provided by source.


Roundcube Webmail is prone to an input-validation vulnerability because it fails to sanitize HTML email messages.

Attackers can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user. Successful attacks can allow attackers to steal cookie-based authentication credentials from legitimate users of the site; other attacks are also possible.

Roundcube Webmail 0.1rc2 is vulnerable; other versions may also be affected.