CVE-2012-3508: XSS
Published Aug 25, 2012
·Updated
Cross-site scripting (XSS) vulnerability in program/lib/washtml.php in Roundcube Webmail 0.8.0 allows remote attackers to inject arbitrary web script or HTML by using "javascript:" in an href attribute in the body of an HTML-formatted email.
Affected Software
1 affected component
Roundcube Webmail=0.8.0
Remediation
Event History
Aug 25, 2012
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-3508?
CVE-2012-3508 has a medium severity rating due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2012-3508?
To fix CVE-2012-3508, upgrade Roundcube Webmail to a version newer than 0.8.0 that addresses this vulnerability.
3
What types of attacks can be performed using CVE-2012-3508?
CVE-2012-3508 can be exploited to perform cross-site scripting attacks by injecting malicious scripts into emails.
4
Which software is affected by CVE-2012-3508?
CVE-2012-3508 specifically affects Roundcube Webmail version 0.8.0.
5
Can CVE-2012-3508 be exploited remotely?
Yes, CVE-2012-3508 can be exploited remotely by attackers sending specially crafted HTML-formatted emails.