Описание
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support, was needed |
| devel | not-affected | 1.5.0+dfsg.1-2 |
| eoan | ignored | end of life |
| esm-apps-legacy/xenial | not-affected | code not present |
| esm-apps/bionic | released | 1.3.6+dfsg.1-1ubuntu0.1~esm2 |
| esm-apps/focal | released | 1.4.3+dfsg.1-1ubuntu0.1~esm2 |
| esm-apps/jammy | not-affected | 1.5.0+dfsg.1-2 |
| esm-apps/noble | not-affected | 1.5.0+dfsg.1-2 |
| esm-apps/xenial | not-affected | code not present |
| esm-infra-legacy/trusty | DNE |
Показывать по
Ссылки на источники
EPSS
4.3 Medium
CVSS2
6.1 Medium
CVSS3
Связанные уязвимости
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x befo ...
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.
Уязвимость веб-почты для IMAP-серверов на основе AJAX Roundcube, связанная с недостатками используемых мер по защите структур веб-страницы, позволяющая нарушителю оказать воздействие на целостность данных
ALT-PU-2020-2319: package `roundcube` update to version 1.4.7-alt1
EPSS
4.3 Medium
CVSS2
6.1 Medium
CVSS3