CVE-2011-1492 | BDVDB-2026-45689 Detail
Description#
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://openwall.com/lists/oss-security/2011/03/24/3
- http://secunia.com/advisories/44050
- http://openwall.com/lists/oss-security/2011/03/24/4
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66613
- http://openwall.com/lists/oss-security/2011/04/04/50
- http://trac.roundcube.net/wiki/Changelog
- http://trac.roundcube.net/changeset/4488
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.