CVE-2017-6820

MEDIUM

Roundcube Webmail < 1.1.8 and 1.2.x < 1.2.4 - Cross-Site Scripting via SVG CSS Token Sequence

Title source: llm
STIX 2.1

Description

rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element.

References (7)

Core 7
Core References
Patch, Release Notes, Third Party Advisory x_refsource_confirm
https://github.com/roundcube/roundcubemail/wiki/Changelog#release-124
Release Notes, Vendor Advisory x_refsource_confirm
https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released
Patch, Release Notes, Third Party Advisory x_refsource_confirm
https://github.com/roundcube/roundcubemail/releases/tag/1.1.8
Patch, Release Notes, Third Party Advisory x_refsource_confirm
https://github.com/roundcube/roundcubemail/releases/tag/1.2.4
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/96817

Scores

CVSS v3 6.1
EPSS 0.0129
EPSS Percentile 66.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (5)
roundcube/webmail 1.2.0
roundcube/webmail 1.2.1
roundcube/webmail 1.2.2
roundcube/webmail 1.2.3
roundcube/webmail < 1.1.7
Published Mar 12, 2017
Tracked Since Feb 18, 2026