CVE-2015-8105: XSS
Cross-site scripting (XSS) vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8105?
CVE-2015-8105 is classified as a medium severity vulnerability due to its potential for cross-site scripting (XSS).
How do I fix CVE-2015-8105?
To fix CVE-2015-8105, upgrade Roundcube webmail to version 1.0.7 or 1.1.3 or later.
What type of vulnerability is CVE-2015-8105?
CVE-2015-8105 is a cross-site scripting (XSS) vulnerability that allows for script injection in file uploads.
Which versions of Roundcube are affected by CVE-2015-8105?
CVE-2015-8105 affects Roundcube webmail versions prior to 1.0.7 and 1.1.x before 1.1.3.
Can authenticated users exploit CVE-2015-8105?
Yes, remote authenticated users can exploit CVE-2015-8105 to inject arbitrary web scripts through file names in drag-and-drop uploads.