PT-2021-24018 · Roundcube+3 · Roundcube+3

Vlmanaf · Publicado 2019-11-09 · Atualizado 2025-01-24 · CVE-2021-44025

Positive Technologies (AI Summary) · Pt

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

**Nome do software vulnerável e versões afetadas:

Versões do Roundcube anteriores à 1.3.17

Versões do Roundcube 1.4.x anteriores à 1.4.12

Descrição:

O problema está relacionado a XSS no tratamento da extensão do nome de arquivo de um anexo ao exibir uma mensagem de aviso de tipo MIME.

Recomendações:

Para versões anteriores à 1.3.17, atualize para a versão 1.3.17 ou posterior.

Para versões 1.4.x anteriores à 1.4.12, atualize para a versão 1.4.12 ou posterior.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2019-3109

ALT-PU-2021-3558

ALT-PU-2025-1825

BIT-ROUNDCUBE-2021-44025

CVE-2021-44025

DLA-2840-1

DSA-5013-1

MGASA-2022-0039

USN-5182-1

Produtos afetados

Alt Linux

Linuxmint

Roundcube

Ubuntu

Referências · 52

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube · Exploit
• 🔥 https://github.com/s3cb0y/CVE-2023-43770-POC · Exploit
• 🔥 https://github.com/pentesttoolscom/roundcube-cve-2021-44026 · Exploit
• 🔥 https://github.com/bartfroklage/CVE-2024-37383-POC · Exploit
• 🔥 https://github.com/knight0x07/CVE-2023-43770-PoC · Exploit
• 🔥❌ https://github.com/greandfather/EXPLOIT-Roundcube-vulnerability-POC-CVE-2023-5631- · Exploit, Deleted
• https://github.com/roundcube/roundcubemail/commit/7d7b1dfeff795390b69905ceb63d6391b5b0dfe7 · Correção
• https://github.com/roundcube/roundcubemail/issues/8193 · Correção
• https://github.com/roundcube/roundcubemail/commit/faf99bf8a2b7b7562206fa047e8de652861e624a · Correção
• https://osv.dev/vulnerability/DSA-5013-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2021-44025 · Nota de Segurança
• https://debian.org/security/2021/dsa-5013 · Aviso do Fabricante