CVE-2015-5381

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://trac.roundcube.net/ticket/1490417Issue Tracking, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/07/07/2Mailing List, Patch, Third Party Advisory
https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fcIssue Tracking, Patch, Third Party Advisory
https://github.com/roundcube/roundcubemail/issues/4837Issue Tracking, Patch, Third Party Advisory
https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-releasedPatch, Vendor Advisory
http://trac.roundcube.net/ticket/1490417Issue Tracking, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/07/07/2Mailing List, Patch, Third Party Advisory
https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fcIssue Tracking, Patch, Third Party Advisory
https://github.com/roundcube/roundcubemail/issues/4837Issue Tracking, Patch, Third Party Advisory
https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-releasedPatch, Vendor Advisory

Timeline

Published: May 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-53826.5program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbit CVE-2015-53837.5Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, o CVE-2015-53848.8AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier is vulnerable to a Session Fixation attack.CVE-2015-53869.3Siemens SICAM MIC devices with firmware before 2404 allow remote attackers to bypass authentication and obtain administrative access via uns CVE-2015-53958.8Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0.CVE-2015-53976.8Cross-site request forgery (CSRF) vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.2 allows remote attackers to hijack the CVE-2015-53995.4Cross-site scripting (XSS) vulnerability in PHPVibe before 4.21 allows remote authenticated users to inject arbitrary web script or HTML via CVE-2015-54006.8Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to CVE-2015-54017.5Teradata Gateway before 15.00.03.02-1 and 15.10.x before 15.10.00.01-1 and TD Express before 15.00.02.08_Sles10 and 15.00.02.08_Sles11 allow CVE-2015-54027.2HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows local user CVE-2015-54034.0HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote aut CVE-2015-54047.5HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote att