CVE-2009-0413

RoundCube Webmail <0.2 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable allows remote attackers to inject arbitrary web script or HTML via the background attribute embedded in an HTML e-mail message.

References (7)

[Vendor Advisory] http://secunia.com/advisories/33622

[Various Sources] http://trac.roundcube.net/changeset/2245

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/48129

[Vendor Advisory] https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00082.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/33372

[Third Party Advisory] http://secunia.com/advisories/33827

[Third Party Advisory] http://www.vupen.com/english/advisories/2009/0192

Scores

EPSS 0.0041

EPSS Percentile 60.8%

Classification

CWE

CWE-79

Status published

Affected Products (2)

roundcube/webmail

n/a/n/a

Timeline

Published Feb 03, 2009

Tracked Since Feb 18, 2026