CVE-2018-19206

 

Published at: - 12-11-2018 06:29

Last modified: - 10-03-2022 03:33

Total changes: - 2

Description

steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.

Common Vulnerability Scoring System (CVSS)

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

 

Verification logic

 

Reference

• https://roundcube.net/news/2018/10/26/update-1.3.8-released
• https://github.com/roundcube/roundcubemail/releases/tag/1.3.8
• DSA-4344-Third Party Advisory

 

Keywords

NVD

 

CVE-2018-19206

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures