PT-2011-4192 · Roundcube · Roundcube Webmail

Publicado 2011-09-21 · Atualizado 2012-02-04 · CVE-2011-2937

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 0.5.4

Description A cross-site scripting (XSS) issue exists in the UI messages functionality, allowing remote attackers to inject arbitrary web script or HTML via the mbox parameter to the default URI. This could potentially lead to unauthorized actions on behalf of the user.

Recommendations For versions prior to 0.5.4, update to version 0.5.4 or later to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-2937

Produtos afetados

Roundcube Webmail

Referências · 15

• 🔥 http://trac.roundcube.net/ticket/1488030 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=731786 · Exploit
• http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html · Aviso do Fabricante
• http://trac.roundcube.net/browser/tags/roundcubemail/v0.5.4/CHANGELOG · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-2937 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-2937 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-2937 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2937 · Nota
• http://sourceforge.net/news/?group_id=139281&id=302769 · Nota
• http://openwall.com/lists/oss-security/2011/08/18/5 · Nota
• https://osv.dev/vulnerability/CVE-2011-2937 · Aviso do Fabricante
• http://securityfocus.com/bid/49229 · Nota
• http://support.apple.com/kb/HT5130 · Nota
• http://openwall.com/lists/oss-security/2011/08/19/15 · Nota
• http://trac.roundcube.net/changeset/5037 · Correção