Description
Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.
References (7)
Core 7
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/roundcube/roundcubemail/commit/8894fddd59b770399eed4ef8d4da5773913b5bf0
Vendor Advisory x_refsource_misc
https://roundcube.net/news/2021/12/30/update-1.5.2-released
Patch, Third Party Advisory x_refsource_misc
https://github.com/roundcube/roundcubemail/commit/b2400a4b592e3094b6c84e6000d512f99ae0eed8
Vendor Advisory x_refsource_misc
https://roundcube.net/news/2021/12/30/security-update-1.4.13-released
Vendor Advisory x_refsource_misc
https://bugs.debian.org/1003027
Third Party Advisory vendor-advisory
x_refsource_debian
https://www.debian.org/security/2022/dsa-5037
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2022/01/msg00005.html
Scores
CVSS v3
6.1
EPSS
0.0106
EPSS Percentile
77.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (4)
debian/debian_linux
9.0
debian/debian_linux
10.0
debian/debian_linux
11.0
roundcube/roundcube
< 1.4.13
Published
Jan 06, 2022
Tracked Since
Feb 18, 2026