CVE-2015-1433 - Vulnerability Details - OpenCVE

program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00585.

Key SSVC decision points have not yet been added.

Vendors	Products
Fedoraproject	Fedora
Opensuse	Opensuse
Roundcube	Webmail

Configuration 1 [-]

AND

cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:opensuse:opensuse:13.1:::::::*
	cpe:2.3:o:opensuse:opensuse:13.2:::::::*

Configuration 2 [-]

cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
Debian DLA	DLA-613-1	roundcube security update
EUVD	EUVD-2015-1568	program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html
http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html
http://roundcube.net/news/2015/01/24/security-update-1.0.5/
http://trac.roundcube.net/changeset/786aa0725/github
http://trac.roundcube.net/ticket/1490227
http://www.openwall.com/lists/oss-security/2015/01/31/3
http://www.openwall.com/lists/oss-security/2015/01/31/6
http://www.securityfocus.com/bid/72401

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2015-02-03T16:00:00

Updated: 2024-08-06T04:40:18.907Z

Reserved: 2015-01-31T00:00:00

Link: CVE-2015-1433

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2015-02-03T16:59:24.983

Modified: 2025-04-12T10:46:40.837

Link: CVE-2015-1433

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-01-31T00:00:00", "descriptions": [{"lang": "en", "value": "program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2015-03-19T15:57:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://trac.roundcube.net/changeset/786aa0725/github"}, {"name": "72401", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/72401"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://trac.roundcube.net/ticket/1490227"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/"}, {"name": "openSUSE-SU-2015:0286", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html"}, {"name": "[oss-security] 20150131 Re: CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2015/01/31/6"}, {"name": "FEDORA-2015-1772", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html"}, {"name": "[oss-security] 20150131 CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2015/01/31/3"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-1433", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://trac.roundcube.net/changeset/786aa0725/github", "refsource": "CONFIRM", "url": "http://trac.roundcube.net/changeset/786aa0725/github"}, {"name": "72401", "refsource": "BID", "url": "http://www.securityfocus.com/bid/72401"}, {"name": "http://trac.roundcube.net/ticket/1490227", "refsource": "CONFIRM", "url": "http://trac.roundcube.net/ticket/1490227"}, {"name": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/", "refsource": "CONFIRM", "url": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/"}, {"name": "openSUSE-SU-2015:0286", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html"}, {"name": "[oss-security] 20150131 Re: CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2015/01/31/6"}, {"name": "FEDORA-2015-1772", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html"}, {"name": "[oss-security] 20150131 CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2015/01/31/3"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T04:40:18.907Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://trac.roundcube.net/changeset/786aa0725/github"}, {"name": "72401", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/72401"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://trac.roundcube.net/ticket/1490227"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/"}, {"name": "openSUSE-SU-2015:0286", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html"}, {"name": "[oss-security] 20150131 Re: CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2015/01/31/6"}, {"name": "FEDORA-2015-1772", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html"}, {"name": "[oss-security] 20150131 CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2015/01/31/3"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-1433", "datePublished": "2015-02-03T16:00:00", "dateReserved": "2015-01-31T00:00:00", "dateUpdated": "2024-08-06T04:40:18.907Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "matchCriteriaId": "6C0D9884-2DC7-4F56-85AA-0582A99316A1", "versionEndIncluding": "1.0.4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*", "matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F", "vulnerable": false}, {"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*", "matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*", "matchCriteriaId": "56BDB5A0-0839-4A20-A003-B8CD56F48171", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email."}, {"lang": "es", "value": "program/lib/Roundcube/rcube_washtml.php en Roundcube anterior a 1.0.5 no cita correctamente las cadenas, lo que permite a atacantes remotos realizar ataques de XSS a trav\u00e9s del atributo de estilo en un email."}], "id": "CVE-2015-1433", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2015-02-03T16:59:24.983", "references": [{"source": "cve@mitre.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html"}, {"source": "cve@mitre.org", "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/"}, {"source": "cve@mitre.org", "url": "http://trac.roundcube.net/changeset/786aa0725/github"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Vendor Advisory"], "url": "http://trac.roundcube.net/ticket/1490227"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2015/01/31/3"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2015/01/31/6"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/72401"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://trac.roundcube.net/changeset/786aa0725/github"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "http://trac.roundcube.net/ticket/1490227"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2015/01/31/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2015/01/31/6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/72401"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}