CVE-2015-8864: XSS
Published Apr 13, 2017
·Updated
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068.
Affected Software
11 affected components
openSUSE Leap=42.1
openSUSE openSUSE=13.1
openSUSE openSUSE=13.2
Roundcube Roundcube Webmail=1.1.1
Roundcube Roundcube Webmail=1.1.2
Roundcube Roundcube Webmail=1.1.3
Roundcube Webmail<=1.0.8
Roundcube Webmail=1.1
Roundcube Webmail=1.1-beta
Roundcube Webmail=1.1-rc
Roundcube Webmail=1.1.4
Remediation
Event History
Apr 13, 2017
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-8864?
CVE-2015-8864 is classified as a medium-severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2015-8864?
To fix CVE-2015-8864, update Roundcube Webmail to version 1.0.9 or 1.1.5 or later.
3
Which versions of Roundcube are affected by CVE-2015-8864?
CVE-2015-8864 affects Roundcube Webmail versions before 1.0.9 and 1.1.x before 1.1.5.
4
What type of vulnerability is CVE-2015-8864?
CVE-2015-8864 is a cross-site scripting (XSS) vulnerability that allows script injection via crafted SVG content.
5
Can CVE-2015-8864 be exploited by remote attackers?
Yes, CVE-2015-8864 allows remote attackers to inject arbitrary web script or HTML into the application.