CVE-2018-19206

MEDIUM6.1EPSS 0.45%

roundcube - security update

Published: 11/12/2018Modified: 3/9/2026

Also known as:DSA-4344-1DEBIAN-CVE-2018-19206

Description

steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.

Affected packages (2)

Debian/roundcubefrom 0, < 1.3.8+dfsg.1-1
Debian/roundcubefrom 0, < 1.2.3+dfsg.1-4+deb9u3

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (1)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2018-19206