PT-2020-4099
CVE-2020-16145
·
تاريخ النشر
2019-11-09
·
تاريخ التحديث
2024-06-15
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions:
Roundcube Webmail versions prior to 1.3.15
Roundcube Webmail versions prior to 1.4.8
Description:
The issue allows stored XSS in HTML messages during message display via a crafted SVG document. This can be exploited by a remote attacker to compromise data integrity. The problem is related to insufficient protection measures for web page structures in the Roundcube Webmail client, specifically in the wash uri function of the rcube washtml.php file.
Recommendations:
For versions prior to 1.3.15, update to version 1.3.15 or later.
For versions prior to 1.4.8, update to version 1.4.8 or later.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾