CVE-2011-2937

Published: Sep 21, 2011Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.

Affected (25)

Products: Roundcube: Webmail

1 product

Configuration A

25 vulnerable

Vulnerable Software	Affected Versions
Roundcube Webmail	Up to 0.5.3
Roundcube Webmail	Version 0.1.1
Roundcube Webmail	Version 0.1
Roundcube Webmail	Version 0.1 alpha
Roundcube Webmail	Version 0.1 beta2
Roundcube Webmail	Version 0.1 beta
Roundcube Webmail	Version 0.1 rc1
Roundcube Webmail	Version 0.1 rc2
Roundcube Webmail	Version 0.2.1
Roundcube Webmail	Version 0.2
Roundcube Webmail	Version 0.2 alpha
Roundcube Webmail	Version 0.2 beta
Roundcube Webmail	Version 0.3.1
Roundcube Webmail	Version 0.3
Roundcube Webmail	Version 0.3 beta
Roundcube Webmail	Version 0.3 rc1
Roundcube Webmail	Version 0.4.1
Roundcube Webmail	Version 0.4.2
Roundcube Webmail	Version 0.4
Roundcube Webmail	Version 0.4 beta
Roundcube Webmail	Version 0.5.1
Roundcube Webmail	Version 0.5.2
Roundcube Webmail	Version 0.5
Roundcube Webmail	Version 0.5 beta
Roundcube Webmail	Version 0.5 rc

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (20)

http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html

Source: secalert@redhat.com

http://sourceforge.net/news/?group_id=139281&id=302769

Source: secalert@redhat.com

http://support.apple.com/kb/HT5130

Source: secalert@redhat.com

http://trac.roundcube.net/browser/tags/roundcubemail/v0.5.4/CHANGELOG

Source: secalert@redhat.com

http://trac.roundcube.net/changeset/5037

Source: secalert@redhat.com

Patch

http://trac.roundcube.net/ticket/1488030

Source: secalert@redhat.com

ExploitPatch

http://www.openwall.com/lists/oss-security/2011/08/18/5

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2011/08/19/15

Source: secalert@redhat.com

http://www.securityfocus.com/bid/49229

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=731786

Source: secalert@redhat.com

ExploitPatch

http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://sourceforge.net/news/?group_id=139281&id=302769

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.apple.com/kb/HT5130

Source: af854a3a-2127-422b-91ae-364da2661108

http://trac.roundcube.net/browser/tags/roundcubemail/v0.5.4/CHANGELOG

Source: af854a3a-2127-422b-91ae-364da2661108

http://trac.roundcube.net/changeset/5037

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://trac.roundcube.net/ticket/1488030

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://www.openwall.com/lists/oss-security/2011/08/18/5

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2011/08/19/15

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/49229

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=731786

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

Timeline

No history available yet.