Unscored severity · published Jan 29, 2010
CVE-2010-0464
Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to…
–
CVSS
2%
EPSS
No
On KEV
Description
Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webmail · Roundcube
through 0.3.1; 0.1; 0.1; 0.1; 0.1; 0.1; +17 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-0464
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-0464
Patch
http://trac.roundcube.net/ticket/1486449
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2010:048
secure.grepular.com
https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail
More from Webmail
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2020-12641
Roundcube Webmail Remote Code Execution Vulnerability
9.3
CVE-2024-42009
RoundCube Webmail Cross-Site Scripting Vulnerability
8.8
CVE-2025-49113
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
7.8
CVE-2017-16651
Roundcube Webmail File Disclosure Vulnerability