Description

Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.

Remediation

References

CVE-2010-0464

Related Vulnerabilities

WordPress Plugin WordPress Video Player Multiple Vulnerabilities (1.5.4)

WordPress Plugin Post Index Cross-Site Request Forgery (0.7.5)

WordPress Plugin WP Mail Log Cross-Site Request Forgery (1.0.1)

WordPress 4.1.x Cross-Domain Flash Injection Vulnerability (4.1 - 4.1.21)

WordPress Plugin WP Editor Arbitrary File Upload (1.2.5.3)

Severity

Medium

Classification

CVE-2010-0464 CWE-200

Tags

Missing Update Known Vulnerabilities