Roundcube Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-6820)

Description

rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element.

Remediation

References

CVE-2017-6820

Related Vulnerabilities

OpenSSL Other Vulnerability (CVE-2002-0656)

WordPress Plugin WP Better Permalinks Cross-Site Request Forgery (3.0.4)

Joomla Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-11327)

MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2025-61639)

Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-28979)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N