CVE-2015-5381 — Cross-site Scripting in Webmail

CWE-79 — Cross-site Scripting8 documents6 sources
Severity
6.1MEDIUMNVD
EPSS
1.2%
top 21.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Roundcube WebmailRoundcube Webmail
Timeline
PublishedMay 23
Latest updateMay 14

Description

Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶Debianroundcube/roundcube_webmail< 1.1.2+dfsg.1-1+3

Patches

Patch: trac.roundcube.net ↗Patch: www.openwall.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-875m-3rwh-hhhp: Cross-site scripting (XSS) vulnerability in program/include/rcmail↗2022-05-14
▶
OSV
CVE-2015-5381: Cross-site scripting (XSS) vulnerability in program/include/rcmail↗2017-05-23
▶
CVEList
CVE-2015-5381: Cross-site scripting (XSS) vulnerability in program/include/rcmail↗2017-05-23
▶

📋Vendor Advisories

1
Debian
CVE-2015-5381: roundcube - Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundc...↗2015
▶

💬Community

3
Bugzilla
CVE-2015-5383 CVE-2015-5382 CVE-2015-5381 roundcubemail: vulnerabilities fixed in 1.1.2 and 1.0.6 [epel-all]↗2015-07-08
▶
Bugzilla
CVE-2015-5383 CVE-2015-5382 CVE-2015-5381 roundcubemail: vulnerabilities fixed in 1.1.2 and 1.0.6 [fedora-all]↗2015-07-08
▶
Bugzilla
CVE-2015-5381 CVE-2015-5382 CVE-2015-5383 roundcubemail: vulnerabilities fixed in 1.1.2 and 1.0.6↗2015-07-08
▶
CVE-2015-5381 — Cross-site Scripting in Webmail | cvebase