CVE-2015-5381

Опубликовано: 23 мая 2017

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.

Ссылки

http://trac.roundcube.net/ticket/1490417
Issue Tracking
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/07/07/2
Mailing List
Patch
Third Party Advisory
https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc
Issue Tracking
Patch
Third Party Advisory
https://github.com/roundcube/roundcubemail/issues/4837
Issue Tracking
Patch
Third Party Advisory
https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released
Patch
Vendor Advisory
http://trac.roundcube.net/ticket/1490417
Issue Tracking
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/07/07/2
Mailing List
Patch
Third Party Advisory
https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc
Issue Tracking
Patch
Third Party Advisory
https://github.com/roundcube/roundcubemail/issues/4837
Issue Tracking
Patch
Third Party Advisory
https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:roundcube:roundcube_webmail:1.1.1:*:*:*:*:*:*:*

cpe:2.3:a:roundcube:webmail:1.1:*:*:*:*:*:*:*

cpe:2.3:a:roundcube:webmail:1.1:beta:*:*:*:*:*:*

cpe:2.3:a:roundcube:webmail:1.1:rc:*:*:*:*:*:*

EPSS

Процентиль: 78%

0.01182

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2015-5381

CVSS3: 6.1

ubuntu

больше 8 лет назад

CVE-2015-5381

CVSS3: 6.1

debian

больше 8 лет назад

Cross-site scripting (XSS) vulnerability in program/include/rcmail.php ...

GHSA-875m-3rwh-hhhp

CVSS3: 6.1

github

больше 3 лет назад

EPSS

Процентиль: 78%

0.01182

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79