CVE-2013-5645 — Cross-site Scripting in Webmail

CWE-79 — Cross-site Scripting6 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 46.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Roundcube Webmail
Timeline
PublishedAug 29
Latest updateMay 17

Description

Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDroundcube/webmail0.9.2+30

Patches

Patch: trac.roundcube.net ↗Patch: trac.roundcube.net ↗Patch: trac.roundcube.net ↗

🔴Vulnerability Details

3
GHSA
GHSA-mm4c-mcq8-g995: Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0↗2022-05-17
▶
CVEList
CVE-2013-5645: Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0↗2013-08-29
▶
OSV
CVE-2013-5645: Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0↗2013-08-29
▶

📋Vendor Advisories

1
Debian
CVE-2013-5645: roundcube - Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before ...↗2013
▶

💬Community

1
Bugzilla
CVE-2013-5645 CVE-2013-5646 roundcubemail: two XSS flaws fixed in 0.9.3↗2013-08-23
▶
CVE-2013-5645 — Cross-site Scripting in Webmail | cvebase