PT-2012-5535 · Roundcube+1 · Roundcube Webmail+1

Alecpl · Published 2012-08-25 · Updated 2016-02-12 · CVE-2012-4668

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Roundcube Webmail version 0.8.1 and earlier

Description The issue is related to a cross-site scripting (XSS) vulnerability. This allows remote attackers to inject arbitrary web script or HTML, specifically via the signature in an email.

Recommendations For Roundcube Webmail version 0.8.1 and earlier, update to a version later than 0.8.1 to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2016-1095

CVE-2012-4668

Affected Products

Alt Linux

Roundcube Webmail

References · 35

• 🔥 https://exploit-db.com/exploits/20549 · Exploit
• https://github.com/roundcube/roundcubemail/commit/c086978f6a91eacb339fd2976202fca9dad2ef32 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2180 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6172 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9587 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3507 · Security Note
• https://osv.dev/vulnerability/CVE-2012-4668 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8105 · Security Note
• https://ubuntu.com/security/CVE-2012-4668 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4668 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4668 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-4668 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2016-1095 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8793 · Security Note
• https://bdu.fstec.ru/vul/2015-02661 · Security Note