Описание
A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 1.6.8+dfsg-1 |
| esm-apps-legacy/xenial | not-affected | code not present |
| esm-apps/bionic | not-affected | code not present |
| esm-apps/focal | not-affected | code not present |
| esm-apps/jammy | released | 1.5.0+dfsg.1-2ubuntu0.1~esm6 |
| esm-apps/noble | released | 1.6.6+dfsg-2ubuntu0.1+esm3 |
| esm-apps/resolute | not-affected | 1.6.8+dfsg-1 |
| esm-apps/xenial | not-affected | code not present |
| focal | ignored | end of standard support, was needs-triage |
| jammy | needed |
Показывать по
Ссылки на источники
9.3 Critical
CVSS3
Связанные уязвимости
A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.
A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() ...
A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.
Уязвимость функции rcmail_action_mail_get->run() почтового клиента RoundCube Webmail, позволяющая нарушителю провести атаку межсайтового скриптинга (XSS)
9.3 Critical
CVSS3