PT-2015-2647 · Roundcube+1 · Roundcube Webmail+1

Published 2015-11-10 · Updated 2018-10-30 · CVE-2015-8105

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions RoundCube Webmail versions prior to 1.0.7 RoundCube Webmail versions 1.1.x prior to 1.1.3

Description The issue exists due to a lack of protection for the web page structure in the RoundCube Webmail component program/js/app.js. This allows a remote attacker to perform cross-site scripting via a specially crafted file name during a drag-n-drop file upload.

Recommendations For versions prior to 1.0.7, update to version 1.0.7 or later. For versions 1.1.x prior to 1.1.3, update to version 1.1.3 or later. As a temporary workaround, consider restricting access to the program/js/app.js component until a patch is available. Avoid using the file name parameter in the affected drag-n-drop file upload functionality until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2016-1095

BDU:2015-12012

CVE-2015-8105

Affected Products

Alt Linux

Roundcube Webmail

References · 33

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2180 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9587 · Security Note
• https://osv.dev/vulnerability/CVE-2015-8105 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8105 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8793 · Security Note
• https://bdu.fstec.ru/vul/2015-02661 · Security Note
• http://lists.opensuse.org/opensuse-updates/2015-11/msg00030.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6121 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8105 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4668 · Security Note
• https://bdu.fstec.ru/vul/2015-12012 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5645 · Security Note
• http://trac.roundcube.net/ticket/1490530 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8105 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6172 · Security Note