Published: 12/12/2007 Updated: 15/10/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 435

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in RoundCube webmail 0.1rc2, 2007-12-09, and previous versions versions, when using Internet Explorer, allows remote malicious users to inject arbitrary web script or HTML via style sheets containing expression commands.

Vulnerable Product	Search on Vulmon	Subscribe to Product
roundcube webmail

Debian Bug report logs - #455840 CVE-2007-6321: Cross-site scripting (XSS) vulnerability Package: roundcube; Maintainer for roundcube is Debian Roundcube Maintainers <pkg-roundcube-maintainers@listsaliothdebianorg>; Source for roundcube is src:roundcube (PTS, buildd, popcon) Reported by: Micah Anderson <micah@debianor ...

source: wwwsecurityfocuscom/bid/26800/info Roundcube Webmail is prone to an input-validation vulnerability because it fails to sanitize HTML email messages Attackers can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user Successful attacks can allow attackers to steal cookie-based authentication ...

CWE-79 http://openmya.hacker.jp/hasegawa/security/expression.txt http://www.securityfocus.com/bid/26800 http://securityreason.com/securityalert/3435 http://secunia.com/advisories/30734 http://trac.roundcube.net/ticket/1484701 https://exchange.xforce.ibmcloud.com/vulnerabilities/38981 http://www.securityfocus.com/archive/1/484802/100/0/threaded https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=455840 https://nvd.nist.gov https://www.exploit-db.com/exploits/30877/

CVE-2007-6321

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect