CVE-2011-2937
published 2011-09-21CVE-2011-2937: Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web…
PriorityP418medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
2.45%
82.4th percentile
Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | roundcube | < roundcube 0.5.4+dfsg-1 (bookworm) | roundcube 0.5.4+dfsg-1 (bookworm) |
| debian | roundcube | < roundcube 1.1.2+dfsg.1-1 (bookworm) | roundcube 1.1.2+dfsg.1-1 (bookworm) |
| roundcube | webmail | <= 0.5.3 | — |
| roundcube | webmail | <= 1.0.5 | — |
| roundcube | webmail | — | — |
| roundcube | webmail | — | — |
| roundcube | webmail | — | — |
| roundcube | webmail | — | — |
| roundcube | webmail | — | — |
| roundcube | webmail | — | — |
| roundcube | webmail | — | — |
| roundcube | webmail | — | — |
| roundcube | webmail | — | — |
| roundcube | webmail | — | — |
| roundcube | webmail | — | — |
| roundcube | webmail | — | — |
| roundcube | webmail | — | — |
| roundcube | webmail | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2015-8793: roundcube - Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundc...
vendor_debian·2015·CVSS 4.3
CVE-2015-8793 [MEDIUM] CVE-2015-8793: roundcube - Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundc...
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937.
Scope: local
bookworm: resolved (fixed in 1.1.2+dfsg.1-1)
bullseye: resolved (fixed in 1.1.2+dfsg.1-1)
forky: resolved (fixed in 1.1.2+dfsg.1-1)
sid: resolved (fixed in 1.1.2+dfsg.1-1)
trixie: resolved (fixed in 1.1.2+dfsg.1-1)
Debian
CVE-2011-2937: roundcube - Cross-site scripting (XSS) vulnerability in the UI messages functionality in Rou...
vendor_debian·2011·CVSS 4.3
CVE-2011-2937 [MEDIUM] CVE-2011-2937: roundcube - Cross-site scripting (XSS) vulnerability in the UI messages functionality in Rou...
Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
Scope: local
bookworm: resolved (fixed in 0.5.4+dfsg-1)
bullseye: resolved (fixed in 0.5.4+dfsg-1)
forky: resolved (fixed in 0.5.4+dfsg-1)
sid: resolved (fixed in 0.5.4+dfsg-1)
trixie: resolved (fixed in 0.5.4+dfsg-1)
GHSA
GHSA-cxwg-vcpf-j5j6: Cross-site scripting (XSS) vulnerability in program/include/rcmail
ghsa_unreviewed·2022-05-17·CVSS 4.3
CVE-2015-8793 [MEDIUM] CWE-79 GHSA-cxwg-vcpf-j5j6: Cross-site scripting (XSS) vulnerability in program/include/rcmail
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937.
GHSA
GHSA-c8f2-q59w-gpfp: Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0
ghsa_unreviewed·2022-05-17
CVE-2011-2937 [MEDIUM] CWE-79 GHSA-c8f2-q59w-gpfp: Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0
Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
OSV
CVE-2015-8793: Cross-site scripting (XSS) vulnerability in program/include/rcmail
osv·2016-01-29·CVSS 4.3
CVE-2015-8793 [MEDIUM] CVE-2015-8793: Cross-site scripting (XSS) vulnerability in program/include/rcmail
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937.
OSV
CVE-2011-2937: Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0
osv·2011-09-21·CVSS 4.3
CVE-2011-2937 [MEDIUM] CVE-2011-2937: Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0
Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
No detection rules found.
No public exploits indexed.
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.htmlhttp://sourceforge.net/news/?group_id=139281&id=302769http://support.apple.com/kb/HT5130http://trac.roundcube.net/browser/tags/roundcubemail/v0.5.4/CHANGELOGhttp://trac.roundcube.net/changeset/5037http://trac.roundcube.net/ticket/1488030http://www.openwall.com/lists/oss-security/2011/08/18/5http://www.openwall.com/lists/oss-security/2011/08/19/15http://www.securityfocus.com/bid/49229https://bugzilla.redhat.com/show_bug.cgi?id=731786http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.htmlhttp://sourceforge.net/news/?group_id=139281&id=302769http://support.apple.com/kb/HT5130http://trac.roundcube.net/browser/tags/roundcubemail/v0.5.4/CHANGELOGhttp://trac.roundcube.net/changeset/5037http://trac.roundcube.net/ticket/1488030http://www.openwall.com/lists/oss-security/2011/08/18/5http://www.openwall.com/lists/oss-security/2011/08/19/15http://www.securityfocus.com/bid/49229https://bugzilla.redhat.com/show_bug.cgi?id=731786
2011-09-21
Published