CVE

Id
49404  
CVE No.
CVE-2011-1492  
Status
Candidate  
Description
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request.  
Phase
Assigned (20110321)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
536252 49404 CVE-2011-1492 MLIST:[oss-security] 20110324 CVE request: roundcube < 0.5.1 CSRF  View
536253 49404 CVE-2011-1492 URL:http://openwall.com/lists/oss-security/2011/03/24/3  View
536254 49404 CVE-2011-1492 MLIST:[oss-security] 20110324 Re: CVE request: roundcube < 0.5.1 CSRF  View
536255 49404 CVE-2011-1492 URL:http://openwall.com/lists/oss-security/2011/03/24/4  View
536256 49404 CVE-2011-1492 MLIST:[oss-security] 20110404 Re: CVE request: roundcube < 0.5.1 CSRF  View
536257 49404 CVE-2011-1492 URL:http://openwall.com/lists/oss-security/2011/04/04/50  View
536258 49404 CVE-2011-1492 CONFIRM:http://trac.roundcube.net/changeset/4488  View
536259 49404 CVE-2011-1492 CONFIRM:http://trac.roundcube.net/wiki/Changelog  View
536260 49404 CVE-2011-1492 SECUNIA:44050  View
536261 49404 CVE-2011-1492 URL:http://secunia.com/advisories/44050  View
536262 49404 CVE-2011-1492 XF:roundcube-modcss-security-bypass(66613)  View

Related JVN