Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Roundcube Webmail 0.5.4 UI Messages Parameter Injection Risk

CVE-2011-2937 · published 15 years ago
Summary

Attackers can inject malicious code into Roundcube Webmail's UI messages, potentially allowing them to steal sensitive information or take control of users' accounts. This vulnerability affects Roundcube Webmail versions prior to 0.5.4. To protect your users, update to the latest version of Roundcube Webmail as soon as possible.

What to do
  • Update debian roundcube to version 0.5.4+dfsg-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian roundcube < 0.5.4+dfsg-1
Fix: upgrade to 0.5.4+dfsg-1
Debian:12 debian roundcube < 0.5.4+dfsg-1
Fix: upgrade to 0.5.4+dfsg-1
Debian:13 debian roundcube < 0.5.4+dfsg-1
Fix: upgrade to 0.5.4+dfsg-1
Debian:14 debian roundcube < 0.5.4+dfsg-1
Fix: upgrade to 0.5.4+dfsg-1
– roundcube webmail <= 0.5.3
0.1
0.1.1
0.2
0.2.1
0.3
0.3.1
0.4
0.4.1
0.4.2
0.5
0.5.1
1 more version range
cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to...
Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
References
Severity
4.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published21 Sep 2011
Updated29 Oct 2026
First seen29 May 2026
Sources
DEBIAN-CVE-2011-2937 · OSV
CVE-2011-2937 · NVD
Track software like this
Free during beta