CVE-2010-0464
Roundcube Webmail < 0.3.1 - Unauthorized DNS Prefetching Exposure
Title source: llmDescription
Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.
References (3)
Core 3
Core References
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:048
Various Sources x_refsource_misc
https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail
Patch x_refsource_confirm
http://trac.roundcube.net/ticket/1486449
Scores
EPSS
0.0196
EPSS Percentile
78.0%
Details
CWE
CWE-200
Status
published
Products (7)
roundcube/webmail
0.1 (11 CPE variants)
roundcube/webmail
0.1.1
roundcube/webmail
0.2 (4 CPE variants)
roundcube/webmail
0.2.1
roundcube/webmail
0.2.2
roundcube/webmail
0.3 (4 CPE variants)
roundcube/webmail
< 0.3.1
Published
Jan 29, 2010
Tracked Since
Feb 18, 2026