- Vendor / Project
- Roundcube
- Product
- Roundcube Webmail
- Date added
- Jun 22, 2023
- Due date
- Jul 13, 2023
- Known ransomware use
- Unknown
- CWEs
- CWE-79
Description
Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.
Required action
Apply updates per vendor instructions.