CVE-2017-6820

Опубликовано: 12 мар. 2017

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element.

Ссылки

http://www.securityfocus.com/bid/96817
https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db00d28ecc1554e9f4
Issue Tracking
Patch
Third Party Advisory
https://github.com/roundcube/roundcubemail/commit/fa2824fdcd44af3f970b2797feb47652482c8305
Issue Tracking
Patch
Third Party Advisory
https://github.com/roundcube/roundcubemail/releases/tag/1.1.8
Patch
Release Notes
Third Party Advisory
https://github.com/roundcube/roundcubemail/releases/tag/1.2.4
Patch
Release Notes
Third Party Advisory
https://github.com/roundcube/roundcubemail/wiki/Changelog#release-124
Patch
Release Notes
Third Party Advisory
https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released
Release Notes
Vendor Advisory
http://www.securityfocus.com/bid/96817
https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db00d28ecc1554e9f4
Issue Tracking
Patch
Third Party Advisory
https://github.com/roundcube/roundcubemail/commit/fa2824fdcd44af3f970b2797feb47652482c8305
Issue Tracking
Patch
Third Party Advisory
https://github.com/roundcube/roundcubemail/releases/tag/1.1.8
Patch
Release Notes
Third Party Advisory
https://github.com/roundcube/roundcubemail/releases/tag/1.2.4
Patch
Release Notes
Third Party Advisory
https://github.com/roundcube/roundcubemail/wiki/Changelog#release-124
Patch
Release Notes
Third Party Advisory
https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*

Версия до 1.1.7 (включая)

cpe:2.3:a:roundcube:webmail:1.2.0:*:*:*:*:*:*:*

cpe:2.3:a:roundcube:webmail:1.2.1:*:*:*:*:*:*:*

cpe:2.3:a:roundcube:webmail:1.2.2:*:*:*:*:*:*:*

cpe:2.3:a:roundcube:webmail:1.2.3:*:*:*:*:*:*:*

EPSS

Процентиль: 70%

0.01293

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2017-6820

CVSS3: 6.1

ubuntu

больше 9 лет назад

CVE-2017-6820

CVSS3: 6.1

debian

больше 9 лет назад

rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is su ...

openSUSE-SU-2017:0742-1

suse-cvrf

больше 9 лет назад

Security update for roundcubemail

GHSA-76mh-6w46-rwcg

CVSS3: 6.1

github

больше 4 лет назад

ALT-PU-2017-1302

CVSS3: 6.1

altlinux

больше 9 лет назад

ALT-PU-2017-1302: package `roundcube` update to version 1.2.4-alt1

EPSS

Процентиль: 70%

0.01293

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79