CVE-2021-26925: XSS
First published: Tue Feb 09 2021(Updated: )
Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Roundcube Webmail | <1.4.11 | |
| Fedoraproject Fedora | =32 | |
| Fedoraproject Fedora | =33 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1bac6fbd683c6d596
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5QPAMYM2DQODSCQIAVNFJR2ETG7WMJOD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q752JPOHTR6H72FK3EIPJZ5O24Z7RGLM/
- https://roundcube.net/news/2021/02/08/security-update-1.4.11
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QPAMYM2DQODSCQIAVNFJR2ETG7WMJOD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q752JPOHTR6H72FK3EIPJZ5O24Z7RGLM/
Frequently Asked Questions
What is CVE-2021-26925?
CVE-2021-26925 is a vulnerability in Roundcube Webmail before version 1.4.11 that allows cross-site scripting (XSS) via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.
How does CVE-2021-26925 impact Roundcube Webmail?
CVE-2021-26925 allows an attacker to execute malicious scripts in the victim's browser when they view a specially crafted email in Roundcube Webmail.
What is the severity of CVE-2021-26925?
CVE-2021-26925 has a severity rating of medium with a CVSS score of 5.4.
Which versions of Roundcube Webmail are affected by CVE-2021-26925?
Roundcube Webmail versions prior to 1.4.11 are affected by CVE-2021-26925.
How can I mitigate the vulnerability CVE-2021-26925?
To mitigate CVE-2021-26925, it is recommended to update Roundcube Webmail to version 1.4.11 or later.
- collector/nvd-index
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/description
- agent/type
- agent/event
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/roundcube
- canonical/roundcube webmail
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/32
- version/fedoraproject fedora/33