CVE-2021-46144: XSS
Published Jan 2, 2022
·Updated
Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.
Affected Software
7 affected componentsFixes available
debian/roundcube
1.3.17+dfsg.1-1~deb10u21.3.17+dfsg.1-1~deb10u31.4.14+dfsg.1-1~deb11u11.4.13+dfsg.1-1~deb11u11.6.3+dfsg-1~deb12u11.6.4+dfsg-1
debian/roundcube<=1.4.12+dfsg.1-1~deb11u1, <=1.5.1+dfsg-1, <=1.3.17+dfsg.1-1~deb10u1, <=1.3.0+dfsg.1-1
1.4.13+dfsg.1-1~deb11u11.3.17+dfsg.1-1~deb10u21.6~beta+dfsg-1
Roundcube Roundcube<1.4.13
Roundcube Roundcube>=1.5.0<1.5.2
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Remediation
Event History
Jan 6, 2022
CVE Published
via MITRE·04:08 AM
Data Sourced
via MITRE·04:08 AM
Description
Data Sourced
via NVD·05:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2021-46144?
CVE-2021-46144 is a vulnerability in Roundcube before version 1.4.13 and 1.5.x before 1.5.2 that allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.
2
How severe is CVE-2021-46144?
CVE-2021-46144 has a severity rating of 6.1 (medium).
3
Which software versions are affected by CVE-2021-46144?
The vulnerability affects Roundcube versions before 1.4.13 and 1.5.x before 1.5.2.
4
How can I fix CVE-2021-46144?
To fix the vulnerability, upgrade Roundcube to version 1.4.13 or 1.5.2.
5
Where can I find more information about CVE-2021-46144?
You can find more information about CVE-2021-46144 at the following references: [link1], [link2], [link3].