CVE-2011-1492
Last modified
CVE-2011-1492 is a vulnerability of currently unknown severity. steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request.. EPSS estimates a 1.76% chance of exploitation in the next 30 days.
Description
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Roundcube | Webmail | <= 0.5 | — |
| Roundcube | Webmail | 0.1 | — |
| Roundcube | Webmail | 0.1.1 | — |
| Roundcube | Webmail | 0.2 | — |
| Roundcube | Webmail | 0.2.1 | — |
| Roundcube | Webmail | 0.3 | — |
| Roundcube | Webmail | 0.3.1 | — |
| Roundcube | Webmail | 0.4 | — |
| Roundcube | Webmail | 0.4.1 | — |
| Roundcube | Webmail | 0.4.2 | — |
| Roundcube | Webmail | 0.5 | Beta |
References
- http://secunia.com/advisories/44050Vendor Advisory
- http://secunia.com/advisories/44050Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2011-1492?
How severe is CVE-2011-1492?
How do I fix CVE-2011-1492?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2011
- CVE-2011-1486libvirtd in libvirt before 0.9.0 does not use thread-safe er…
- CVE-2011-1487The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions i…
- CVE-2011-1488A memory leak in rsyslog before 5.7.6 was found in the way d…5.5
- CVE-2011-1489A memory leak in rsyslog before 5.7.6 was found in the way d…5.5
- CVE-2011-1490A memory leak in rsyslog before 5.7.6 was found in the way d…5.5
- CVE-2011-1491The login form in Roundcube Webmail before 0.5.1 does not pr…
- CVE-2011-1493Array index error in the rose_parse_national function in net…
- CVE-2011-1494Integer overflow in the _ctl_do_mpt_command function in driv…
- CVE-2011-1495drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.3…
- CVE-2011-1496tmux 1.3 and 1.4 does not properly drop group privileges, wh…
- CVE-2011-1497A cross-site scripting vulnerability flaw was found in the a…6.1
- CVE-2011-1498Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents,…
Are you affected by CVE-2011-1492?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST