CVE-2015-1433

EPSS 0.68%

Published: 2/3/2015Modified: 5/29/2026

Also known as:DEBIAN-CVE-2015-1433

Description

program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email.

Affected packages (1)

Debian/roundcubefrom 0, < 0.9.5+dfsg1-4.2

References (1)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2015-1433