Описание
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
Ссылки
- Issue TrackingMailing List
- Patch
- Release Notes
- Release Notes
- Release Notes
- Mailing ListRelease Notes
- Mailing ListRelease Notes
- Product
- Broken Link
- Issue TrackingMailing List
- Patch
- Release Notes
- Release Notes
- Release Notes
- Mailing ListRelease Notes
- Mailing ListRelease Notes
- Product
- Broken Link
- US Government Resource
Уязвимые конфигурации
Одно из
Одно из
EPSS
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
Связанные уязвимости
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x ...
linkref_addindex in rcube_string_replacer.php in Roundcube Webmail before 1.4.10 allows XSS via a crafted email message.
Уязвимость функции linkref_addindex компонента rcube_string_replacer.php почтового клиента Roundcube, связанная с недостатками используемых мер по защите структур веб-страницы, позволяющая нарушителю оказать воздействие на целостность данных
EPSS
6.1 Medium
CVSS3
4.3 Medium
CVSS2