Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-1433

program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email.

Published

2015-02-03T16:59:24.983

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	roundcube	webmail	≤ 1.0.4	Yes
Operating System	opensuse	opensuse	13.1	No
Operating System	opensuse	opensuse	13.2	No
Operating System	fedoraproject	fedora	21	Yes

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html ([email protected])
http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html ([email protected])
http://roundcube.net/news/2015/01/24/security-update-1.0.5/ Patch, Vendor Advisory ([email protected])
http://trac.roundcube.net/changeset/786aa0725/github ([email protected])
http://trac.roundcube.net/ticket/1490227 Exploit, Vendor Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2015/01/31/3 ([email protected])
http://www.openwall.com/lists/oss-security/2015/01/31/6 ([email protected])
http://www.securityfocus.com/bid/72401 ([email protected])
http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html (af854a3a-2127-422b-91ae-364da2661108)
http://roundcube.net/news/2015/01/24/security-update-1.0.5/ Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://trac.roundcube.net/changeset/786aa0725/github (af854a3a-2127-422b-91ae-364da2661108)
http://trac.roundcube.net/ticket/1490227 Exploit, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2015/01/31/3 (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2015/01/31/6 (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/72401 (af854a3a-2127-422b-91ae-364da2661108)