PT-2021-24018 · Roundcube+3 · Roundcube+3

Vlmanaf · Published 2019-11-09 · Updated 2025-01-24 · CVE-2021-44025

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Roundcube versions prior to 1.3.17 Roundcube versions 1.4.x prior to 1.4.12

Description: The issue is related to XSS in handling an attachment's filename extension when displaying a MIME type warning message.

Recommendations: For versions prior to 1.3.17, update to version 1.3.17 or later. For versions 1.4.x prior to 1.4.12, update to version 1.4.12 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2019-3109

ALT-PU-2021-3558

ALT-PU-2025-1825

BIT-ROUNDCUBE-2021-44025

CVE-2021-44025

DLA-2840-1

DSA-5013-1

MGASA-2022-0039

USN-5182-1

Affected Products

Alt Linux

Linuxmint

Roundcube

Ubuntu

References · 52

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube · Exploit
• 🔥 https://github.com/s3cb0y/CVE-2023-43770-POC · Exploit
• 🔥 https://github.com/pentesttoolscom/roundcube-cve-2021-44026 · Exploit
• 🔥 https://github.com/bartfroklage/CVE-2024-37383-POC · Exploit
• 🔥 https://github.com/knight0x07/CVE-2023-43770-PoC · Exploit
• 🔥❌ https://github.com/greandfather/EXPLOIT-Roundcube-vulnerability-POC-CVE-2023-5631- · Exploit, Deleted
• https://github.com/roundcube/roundcubemail/commit/7d7b1dfeff795390b69905ceb63d6391b5b0dfe7 · Patch
• https://github.com/roundcube/roundcubemail/issues/8193 · Patch
• https://github.com/roundcube/roundcubemail/commit/faf99bf8a2b7b7562206fa047e8de652861e624a · Patch
• https://osv.dev/vulnerability/DSA-5013-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-44025 · Security Note
• https://debian.org/security/2021/dsa-5013 · Vendor Advisory