Webmail CVE-2012-4668 Cross-Site Scripting Vulnerability
BID:73855
Info
Webmail CVE-2012-4668 Cross-Site Scripting Vulnerability
| Bugtraq ID: | 73855 |
| Class: | Input Validation Error |
| CVE: |
CVE-2012-4668 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 25 2012 12:00AM |
| Updated: | Aug 25 2012 12:00AM |
| Credit: | Unknown |
| Vulnerable: |
Roundcube Webmail 0.8.1 Roundcube Webmail 0.8 Roundcube Webmail 0.7.3 Roundcube Webmail 0.7.2 Roundcube Webmail 0.5.2 Roundcube Webmail 0.5.1 Roundcube Webmail 0.4.2 Roundcube Webmail 0.2.2 Roundcube Webmail 0.2.1 Roundcube Webmail 0.1.1 Roundcube Webmail 0.0.13 Roundcube Webmail 0.7 Roundcube Webmail 0.6 Roundcube Webmail 0.5.4 Roundcube Webmail 0.5.3 Roundcube Webmail 0.5 Rc Roundcube Webmail 0.5 Beta Roundcube Webmail 0.5 Roundcube Webmail 0.4.1 Roundcube Webmail 0.4 Beta Roundcube Webmail 0.4 Roundcube Webmail 0.3.1 Roundcube Webmail 0.3 Rc1 Roundcube Webmail 0.3 Beta Roundcube Webmail 0.3 Roundcube Webmail 0.2 Beta Roundcube Webmail 0.2 alpha Roundcube Webmail 0.2 Roundcube Webmail 0.1 Rc2 Roundcube Webmail 0.1 Rc1 Roundcube Webmail 0.1 Beta2 Roundcube Webmail 0.1 Beta Roundcube Webmail 0.1 Alpha Roundcube Webmail 0.1 |
| Not Vulnerable: | |
Discussion
Webmail CVE-2012-4668 Cross-Site Scripting Vulnerability
Webmail is prone to a cross-site scripting vulnerability. Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email.
Webmail is prone to a cross-site scripting vulnerability. Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email.
Exploit / POC
Webmail CVE-2012-4668 Cross-Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
Solution / Fix
Webmail CVE-2012-4668 Cross-Site Scripting Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]
References
Webmail CVE-2012-4668 Cross-Site Scripting Vulnerability
References:
References:
- #1488613 closed Bugs (fixed) (Roundcube)
- Fix XSS issue where plain signatures wasn't secured in HTML mode (github)
- http://sourceforge.net/news/?group_id=139281&id=309011 (MISC)
- http://www.openwall.com/lists/oss-security/2012/08/20/2 (MISC)
- http://www.openwall.com/lists/oss-security/2012/08/20/9 (MISC)