PT-2021-7305 · Roundcube+3 · Roundcube+3

Alecpl · Published 2021-12-29 · Updated 2025-01-24 · CVE-2021-46144

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Roundcube versions 1.4.13 and earlier, 1.5.x before 1.5.2

Description The issue allows for cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in HTML e-mail messages. This can enable a remote attacker to conduct cross-site scripting attacks by sending a specially crafted email message. The vulnerability is related to the lack of protection measures for the web page structure when processing CSS styles.

Recommendations For versions 1.4.13 and earlier, update to version 1.4.13 or later. For versions 1.5.x before 1.5.2, update to version 1.5.2 or later. As a temporary workaround, consider restricting the processing of CSS styles in HTML email messages until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2022-1073

ALT-PU-2025-1825

BDU:2022-05555

CVE-2021-46144

DLA-2878-1

DSA-5037-1

USN-5182-1

Affected Products

Alt Linux

Linuxmint

Roundcube

Ubuntu

References · 44

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/s3cb0y/CVE-2023-43770-POC · Exploit
• 🔥 https://github.com/pentesttoolscom/roundcube-cve-2021-44026 · Exploit
• 🔥 https://github.com/bartfroklage/CVE-2024-37383-POC · Exploit
• 🔥 https://github.com/knight0x07/CVE-2023-43770-PoC · Exploit
• 🔥❌ https://github.com/greandfather/EXPLOIT-Roundcube-vulnerability-POC-CVE-2023-5631- · Exploit, Deleted
• https://github.com/roundcube/roundcubemail/commit/b2400a4b592e3094b6c84e6000d512f99ae0eed8 · Patch
• https://github.com/roundcube/roundcubemail/commit/8894fddd59b770399eed4ef8d4da5773913b5bf0 · Patch
• https://nvd.nist.gov/vuln/detail/cve-2021-46144 · Security Note
• https://roundcube.net/news/2021/12/30/security-update-1.4.13-released · Vendor Advisory
• https://debian.org/security/2022/dsa-5037 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-16145 · Vendor Advisory