Description

steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request.

Remediation

References

CVE-2011-1492

Related Vulnerabilities

WordPress Plugin SCORM Cloud For WordPress 'ajax.php' SQL Injection (1.0.6.6)

WordPress Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2008-0195)

WordPress Plugin Gallery Categories by BestWebSoft Cross-Site Scripting (1.0.8)

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-1999005)

WordPress Plugin WP-Lytebox 'pg' Parameter Local File Inclusion (1.3)

Severity

Medium

Classification

CVE-2011-1492 CWE-20

Tags

Missing Update Known Vulnerabilities