Roundcube XSS vulnerability opens the door to email account takeover

guest · Jul 23, 2020

Roundcube XSS vulnerability opens the door to email account takeover
Open source webmail provider fixes a serious bug that can be triggered via malicious emails
July 22, 2020
https://portswigger.net/daily-swig/...lity-opens-the-door-to-email-account-takeover

Roundcube is urging users to update their installations to resolve a security vulnerability that can be exploited to conduct stored, or persistent, cross-site scripting (XSS) attacks.

On July 21, an advisory was published concerning CVE-2020-15562, a vulnerability present in the Roundcube stable version 1.4 and LTS versions 1.3 and 1.2.
Written in PHP, Roundcube is an open source webmail project which offers a browser-based skinnable IMAP client in multiple languages. Features include MIME support, an address book, folders, and message search functionality.
Click to expand...

Input sanitization issue
Discovered by independent security researcher Andrea Cardaci and reported to the SSD Secure Disclosure program, the flaw – deemed “medium-severity” by NVD – represents an input sanitization issue that can be exploited to perform stored XSS attacks.

Discussing the potential ramifications of the exploit, Cardaci told The Daily Swig: “A successful attack allows the execution of arbitrary JavaScript code in the context of the authenticated victim's session, thus basically impersonating the logged-in user.
In an advisory posted July 5, Roundcube said it “strongly recommends” users to update their software to prevent themselves becoming victim to XSS attacks made possible through the security issue.
Click to expand...

Log in or Sign up

Roundcube XSS vulnerability opens the door to email account takeover

guest Guest

Log in or Sign up

Roundcube XSS vulnerability opens the door to email account takeover

guest Guest

Useful Searches