CVE-2018-19206 PUBLISHED

steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.

EPSS 2.36% · 84.8th percentile

Risk Scores

EPSS Score
2.36%
84.8th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:16.04:LTSroundcube0, 1.1.1+dfsg.1-2, 1.1.2+dfsg.1-5
Ubuntu:Pro:18.04:LTSroundcube0, 1.3.0+dfsg.1-1, 1.3.1+dfsg.1-1

Timeline

References

Open in Interactive Console →