CVE-2012-6121: XSS
Published Feb 24, 2013
·Updated
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link.
Affected Software
38 affected components
Roundcube Webmail<=0.8.4
Roundcube Webmail=0.1-beta
Roundcube Webmail=0.1-beta2
Roundcube Webmail=0.1-rc1
Roundcube Webmail=0.1-rc2
Roundcube Webmail=0.1-stable
Roundcube Webmail=0.1.1
Roundcube Webmail=0.2
Roundcube Webmail=0.2-alpha
Roundcube Webmail=0.2-beta
Roundcube Webmail=0.2-stable
Roundcube Webmail=0.2.1
Roundcube Webmail=0.2.2
Roundcube Webmail=0.3
Roundcube Webmail=0.3-beta
Roundcube Webmail=0.3-rc1
Roundcube Webmail=0.3-stable
Roundcube Webmail=0.3.1
Roundcube Webmail=0.4
Roundcube Webmail=0.4-beta
Roundcube Webmail=0.4.1
Roundcube Webmail=0.4.2
Roundcube Webmail=0.5
Roundcube Webmail=0.5-beta
Roundcube Webmail=0.5-rc
Roundcube Webmail=0.5.1
Roundcube Webmail=0.5.2
Roundcube Webmail=0.5.3
Roundcube Webmail=0.5.4
Roundcube Webmail=0.6
Roundcube Webmail=0.7
Roundcube Webmail=0.7.1
Roundcube Webmail=0.7.2
Roundcube Webmail=0.7.3
Roundcube Webmail=0.8.0
Roundcube Webmail=0.8.1
Roundcube Webmail=0.8.2
Roundcube Webmail=0.8.3
Event History
Feb 24, 2013
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-6121?
CVE-2012-6121 is classified as a moderate severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2012-6121?
To fix CVE-2012-6121, update Roundcube Webmail to version 0.8.5 or later.
3
What software versions are affected by CVE-2012-6121?
CVE-2012-6121 affects all versions of Roundcube Webmail prior to 0.8.5, including various beta and release candidates.
4
Can CVE-2012-6121 be exploited remotely?
Yes, CVE-2012-6121 allows remote attackers to inject arbitrary web scripts or HTML.
5
What is cross-site scripting (XSS) in the context of CVE-2012-6121?
In the context of CVE-2012-6121, cross-site scripting (XSS) is a vulnerability that enables attackers to execute scripts in the web browser of a victim.