Veracode Vulnerability DatabaseVERACODE:33072Cross-site Scripting (XSS)
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
roundcube:sid is vulnerable to cross-site scripting (XSS) attacks. The library is prone to XSS in handling an attachment’s filename extension when displaying a MIME type warning message.
References
bugs.debian.org/1000156
github.com/roundcube/roundcubemail/commit/7d7b1dfeff795390b69905ceb63d6391b5b0dfe7
github.com/roundcube/roundcubemail/commit/faf99bf8a2b7b7562206fa047e8de652861e624a
github.com/roundcube/roundcubemail/issues/8193
lists.debian.org/debian-lts-announce/2021/12/msg00004.html
lists.fedoraproject.org/archives/list/[email protected]/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/
lists.fedoraproject.org/archives/list/[email protected]/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/
security-tracker.debian.org/tracker/CVE-2021-44025
www.debian.org/security/2021/dsa-5013
Related
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N