CVE-2012-3507: XSS

Q: What is the severity of CVE-2012-3507?

CVE-2012-3507 is classified as a medium severity vulnerability due to its potential for cross-site scripting (XSS) attacks.

Q: How do I fix CVE-2012-3507?

To mitigate CVE-2012-3507, it is recommended to upgrade RoundCube Webmail to version 0.8.0 or later.

Q: Which versions of RoundCube Webmail are affected by CVE-2012-3507?

CVE-2012-3507 affects RoundCube Webmail versions prior to 0.8.0, including versions up to 0.7.3.

Q: What type of vulnerability is CVE-2012-3507?

CVE-2012-3507 is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web scripts.

Q: In which component of RoundCube Webmail does CVE-2012-3507 exist?

CVE-2012-3507 exists in the program/steps/mail/func.inc file when using the Larry skin.

Published Aug 25, 2012

Updated

Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary web script or HTML via the email message subject.

Affected Software

39 affected components

Roundcube Webmail<=0.7.3

Roundcube Webmail=0.1

Roundcube Webmail=0.1-20050811

Roundcube Webmail=0.1-20050820

Roundcube Webmail=0.1-20051007

Roundcube Webmail=0.1-20051021

Roundcube Webmail=0.1-alpha

Roundcube Webmail=0.1-beta

Roundcube Webmail=0.1-beta2

Roundcube Webmail=0.1-rc1

Roundcube Webmail=0.1-rc2

Roundcube Webmail=0.1-stable

Roundcube Webmail=0.1.1

Roundcube Webmail=0.2

Roundcube Webmail=0.2-alpha

Roundcube Webmail=0.2-beta

Roundcube Webmail=0.2-stable

Roundcube Webmail=0.2.1

Roundcube Webmail=0.2.2

Roundcube Webmail=0.3

Roundcube Webmail=0.3-beta

Roundcube Webmail=0.3-rc1

Roundcube Webmail=0.3-stable

Roundcube Webmail=0.3.1

Roundcube Webmail=0.4

Roundcube Webmail=0.4-beta

Roundcube Webmail=0.4.1

Roundcube Webmail=0.4.2

Roundcube Webmail=0.5

Roundcube Webmail=0.5-beta

Roundcube Webmail=0.5-rc

Roundcube Webmail=0.5.1

Roundcube Webmail=0.5.2

Roundcube Webmail=0.5.3

Roundcube Webmail=0.5.4

Roundcube Webmail=0.6

Roundcube Webmail=0.7

Roundcube Webmail=0.7.1

Roundcube Webmail=0.7.2

Event History

Aug 25, 2012

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-3507?

CVE-2012-3507 is classified as a medium severity vulnerability due to its potential for cross-site scripting (XSS) attacks.

How do I fix CVE-2012-3507?

To mitigate CVE-2012-3507, it is recommended to upgrade RoundCube Webmail to version 0.8.0 or later.

Which versions of RoundCube Webmail are affected by CVE-2012-3507?