CVE Vulnerability Advisory Database

[Affected Scope] Roundcube Webmail versions before 1.5.12 and 1.6.x versions before 1.6.12

[Impact] Remote attackers can execute arbitrary JavaScript code in the context of the victim's browser session via a malicious SVG attachment, leading to session hijacking and unauthorized email access

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions 1.5.12 or 1.6.12

[Affected Scope] Roundcube Webmail versions before 1.5.10 and 1.6.x versions before 1.6.11

[Impact] Authenticated remote attackers can trigger PHP Object Deserialization via the manipulated _from parameter, leading to arbitrary Remote Code Execution (RCE) on the host server

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.10, 1.6.11, or later)

[Affected Scope] Roundcube Webmail versions through 1.5.7 and 1.6.x through 1.6.7

[Impact] A remote attacker can execute malicious scripts in the victim's browser session by sending a crafted email, enabling unauthorized access, theft, and transmission of the victim's emails.

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.8, 1.6.8, or later).

[Affected Scope] Roundcube Webmail versions prior to 1.5.7 and 1.6.x versions prior to 1.6.7

[Impact] Remote attackers can execute arbitrary JavaScript code in the victim's browser session by sending a crafted email containing malicious SVG animate attributes, leading to session hijacking

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.7, 1.6.7, or later)

[Affected Scope] Roundcube versions before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4

[Impact] Remote attackers can execute arbitrary JavaScript code in the victim's browser session by sending a crafted HTML email containing a malicious SVG document

[Mitigation] Immediately upgrade Roundcube to the patched versions (1.4.15, 1.5.5, or 1.6.4 and above)

[Affected Scope] Roundcube Webmail versions before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3

[Impact] Remote attackers can execute arbitrary JavaScript code in the victim's browser session by sending a crafted text/plain email, potentially leading to session hijacking and account takeover

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.4.14, 1.5.4, 1.6.3, or later) and enforce strict Content Security Policies

[Affected Scope] Roundcube versions before 1.3.17 and 1.4.x versions before 1.4.12

[Impact] Unauthenticated attackers can manipulate search parameters to extract sensitive database information or potentially achieve remote code execution (RCE)

[Mitigation] Immediately upgrade Roundcube to the latest stable releases (1.3.17, 1.4.12, or higher)

[Affected Scope] Roundcube Webmail versions before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10

[Impact] Remote attackers can execute arbitrary JavaScript in the victim's browser session by sending a specially crafted plain text email, potentially leading to session hijacking

[Mitigation] Immediately upgrade Roundcube Webmail to version 1.2.13, 1.3.16, or 1.4.10 or higher

[Affected Scope] Roundcube Webmail versions before 1.3.12 and 1.4.x before 1.4.5

[Impact] Attackers can execute arbitrary JavaScript in the victim's browser session via a malicious XML attachment preview, leading to session hijacking

[Mitigation] Immediately upgrade Roundcube Webmail to patched versions 1.3.12, 1.4.5, or later

[Affected Scope] Roundcube Webmail versions before 1.4.4

[Impact] Unauthenticated attackers can execute arbitrary OS commands and gain full control of the mail server via shell metacharacters

[Mitigation] Immediately upgrade Roundcube Webmail to version 1.4.4 or later and restrict ImageMagick configuration paths