PT-2011-3164 · Roundcube · Roundcube Webmail

Hanno Böck · Publicado 2011-04-08 · Atualizado 2017-08-17 · CVE-2011-1492

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 0.5.1

Description The issue allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request. This is due to the improper verification of requests for external Cascading Style Sheets (CSS) stylesheets in the steps/utils/modcss.inc file.

Recommendations For versions prior to 0.5.1, update to version 0.5.1 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-1492

Produtos afetados

Roundcube Webmail

Referências · 12

• http://trac.roundcube.net/wiki/Changelog · Nota
• http://openwall.com/lists/oss-security/2011/03/24/3 · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-1492 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66613 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1492 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-1492 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1492 · Nota
• https://osv.dev/vulnerability/CVE-2011-1492 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2011/04/04/50 · Correção
• http://trac.roundcube.net/changeset/4488 · Correção
• http://secunia.com/advisories/44050 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2011/03/24/4 · Correção