Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade roundcube | Dec 11, 2023 | Nov 6, 2023 |
| Suse | — | Upgrade roundcubemail | Aug 22, 2024 | Nov 6, 2023 |
| Ubuntu | — | Upgrade roundcube (Ubuntu Pro)Upgrade roundcube-core (Ubuntu Pro)Upgrade roundcube-coreUpgrade roundcube | Jun 27, 2024 | Nov 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub