CVE-2015-1433 in Webmail
Summary
program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Reservation
01/31/2015
Disclosure
02/03/2015
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 73854 | Roundcube Webmail rcube_washtml.php cross site scripting | 79 | Not defined | Official fix | CVE-2015-1433 |