CVE-2012-3508

Name of the Vulnerable Software and Affected Versions Roundcube Webmail version 0.8.0

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML by using "javascript:" in an href attribute in the body of an HTML-formatted email. This occurs in the program/lib/washtml.php file.

Recommendations For Roundcube Webmail version 0.8.0, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting the use of HTML-formatted emails to minimize the risk of exploitation.