Unscored severity · published Apr 8, 2011
CVE-2011-1492
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet,…
–
CVSS
1.8%
EPSS
No
On KEV
Description
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webmail · Roundcube
through 0.5; 0.1; 0.1; 0.1; 0.1; 0.1; +16 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1492
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1492
openwall.com
http://openwall.com/lists/oss-security/2011/03/24/3
Patch
http://openwall.com/lists/oss-security/2011/03/24/4
Patch
http://openwall.com/lists/oss-security/2011/04/04/50
Vendor Advisory
http://secunia.com/advisories/44050
Patch
http://trac.roundcube.net/changeset/4488
trac.roundcube.net
http://trac.roundcube.net/wiki/Changelog
More from Webmail
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2020-12641
Roundcube Webmail Remote Code Execution Vulnerability
9.3
CVE-2024-42009
RoundCube Webmail Cross-Site Scripting Vulnerability
8.8
CVE-2025-49113
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
7.8
CVE-2017-16651
Roundcube Webmail File Disclosure Vulnerability