Описание
An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-apps-legacy/xenial | needs-triage | |
| esm-apps/bionic | needs-triage | |
| esm-apps/focal | needs-triage | |
| esm-apps/jammy | needs-triage | |
| esm-apps/noble | needs-triage | |
| esm-apps/resolute | needs-triage | |
| esm-apps/xenial | ignored | end of ESM support, was needs-triage |
| jammy | needs-triage | |
| noble | needs-triage |
Показывать по
Ссылки на источники
5.3 Medium
CVSS3
Связанные уязвимости
An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.
An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. ...
Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message
Уязвимость функции удаленной блокировки изображений почтового клиента RoundCube Webmail, позволяющая нарушителю раскрыть защищаемую информацию и обойти существующие ограничения безопасности
5.3 Medium
CVSS3