CVE-2015-1433 - Vulnerability Details - OpenCVE

program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00585.

Key SSVC decision points have not yet been added.

Vendors	Products
Fedoraproject Subscribe	Fedora Subscribe
Opensuse Subscribe	Opensuse Subscribe
Roundcube Subscribe	Webmail Subscribe

Configuration 1 [-]

AND

cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:opensuse:opensuse:13.1:::::::*
	cpe:2.3:o:opensuse:opensuse:13.2:::::::*

Configuration 2 [-]

cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
Debian DLA	DLA-613-1	roundcube security update
EUVD	EUVD-2015-1568	program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html
http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html
http://roundcube.net/news/2015/01/24/security-update-1.0.5/
http://trac.roundcube.net/changeset/786aa0725/github
http://trac.roundcube.net/ticket/1490227
http://www.openwall.com/lists/oss-security/2015/01/31/3
http://www.openwall.com/lists/oss-security/2015/01/31/6
http://www.securityfocus.com/bid/72401

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2015-02-03T16:00:00

Updated: 2024-08-06T04:40:18.907Z

Reserved: 2015-01-31T00:00:00

Link: CVE-2015-1433

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2015-02-03T16:59:24.983

Modified: 2025-04-12T10:46:40.837

Link: CVE-2015-1433

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-79

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-01-31T00:00:00", "descriptions": [{"lang": "en", "value": "program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2015-03-19T15:57:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://trac.roundcube.net/changeset/786aa0725/github"}, {"name": "72401", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/72401"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://trac.roundcube.net/ticket/1490227"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/"}, {"name": "openSUSE-SU-2015:0286", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html"}, {"name": "[oss-security] 20150131 Re: CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2015/01/31/6"}, {"name": "FEDORA-2015-1772", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html"}, {"name": "[oss-security] 20150131 CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2015/01/31/3"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-1433", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://trac.roundcube.net/changeset/786aa0725/github", "refsource": "CONFIRM", "url": "http://trac.roundcube.net/changeset/786aa0725/github"}, {"name": "72401", "refsource": "BID", "url": "http://www.securityfocus.com/bid/72401"}, {"name": "http://trac.roundcube.net/ticket/1490227", "refsource": "CONFIRM", "url": "http://trac.roundcube.net/ticket/1490227"}, {"name": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/", "refsource": "CONFIRM", "url": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/"}, {"name": "openSUSE-SU-2015:0286", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html"}, {"name": "[oss-security] 20150131 Re: CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2015/01/31/6"}, {"name": "FEDORA-2015-1772", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html"}, {"name": "[oss-security] 20150131 CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2015/01/31/3"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T04:40:18.907Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://trac.roundcube.net/changeset/786aa0725/github"}, {"name": "72401", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/72401"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://trac.roundcube.net/ticket/1490227"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/"}, {"name": "openSUSE-SU-2015:0286", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html"}, {"name": "[oss-security] 20150131 Re: CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2015/01/31/6"}, {"name": "FEDORA-2015-1772", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html"}, {"name": "[oss-security] 20150131 CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2015/01/31/3"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-1433", "datePublished": "2015-02-03T16:00:00", "dateReserved": "2015-01-31T00:00:00", "dateUpdated": "2024-08-06T04:40:18.907Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "matchCriteriaId": "6C0D9884-2DC7-4F56-85AA-0582A99316A1", "versionEndIncluding": "1.0.4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*", "matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F", "vulnerable": false}, {"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*", "matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*", "matchCriteriaId": "56BDB5A0-0839-4A20-A003-B8CD56F48171", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email."}, {"lang": "es", "value": "program/lib/Roundcube/rcube_washtml.php en Roundcube anterior a 1.0.5 no cita correctamente las cadenas, lo que permite a atacantes remotos realizar ataques de XSS a trav\u00e9s del atributo de estilo en un email."}], "id": "CVE-2015-1433", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2015-02-03T16:59:24.983", "references": [{"source": "cve@mitre.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html"}, {"source": "cve@mitre.org", "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/"}, {"source": "cve@mitre.org", "url": "http://trac.roundcube.net/changeset/786aa0725/github"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Vendor Advisory"], "url": "http://trac.roundcube.net/ticket/1490227"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2015/01/31/3"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2015/01/31/6"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/72401"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://trac.roundcube.net/changeset/786aa0725/github"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "http://trac.roundcube.net/ticket/1490227"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2015/01/31/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2015/01/31/6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/72401"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}