CVE-2011-1492

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 0.5.1

Description The issue allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request. This is due to the improper verification of requests for external Cascading Style Sheets (CSS) stylesheets in the steps/utils/modcss.inc file.

Recommendations For versions prior to 0.5.1, update to version 0.5.1 or later to resolve the issue.