CVE Feed

    Dashboard / CVE / CVE-2017-6820

    CVE-2017-6820

    rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element.

    Published:Mar 12, 2017
    Last Modified:Apr 20, 2025
    EPS:Mar 12, 2017
    EPSS Score:0.00556
    CVSS Score:6.1

    Affected Products

    Vendor
    Roundcube
    Product
    Webmail

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-75010 (CVSS 6.4) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could lea…
    CVE-2026-75007 (CVSS 5.4) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via…
    CVE-2026-75006 (CVSS 5.8) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitizat…
    CVE-2026-75004 (CVSS 4.3) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesiev…
    CVE-2026-75003 (CVSS 5.8) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG …
    CVE-2026-75002 (CVSS 7.1) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronizati…
    CVE-2026-75000 (CVSS 5.8) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "…
    CVE-2026-74999 (CVSS 5.4) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to sto…
    CVE-2026-74998 (CVSS 7.2) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) pro…
    CVE-2026-74997 (CVSS 8.8) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is su…

    References

    http://www.securityfocus.com/bid/96817
    https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db00d28ecc1554e9f4
    https://github.com/roundcube/roundcubemail/commit/fa2824fdcd44af3f970b2797feb47652482c8305
    https://github.com/roundcube/roundcubemail/releases/tag/1.1.8
    https://github.com/roundcube/roundcubemail/releases/tag/1.2.4
    https://github.com/roundcube/roundcubemail/wiki/Changelog#release-124
    https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released
    http://www.securityfocus.com/bid/96817
    https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db00d28ecc1554e9f4
    https://github.com/roundcube/roundcubemail/commit/fa2824fdcd44af3f970b2797feb47652482c8305
    https://github.com/roundcube/roundcubemail/releases/tag/1.1.8
    https://github.com/roundcube/roundcubemail/releases/tag/1.2.4
    https://github.com/roundcube/roundcubemail/wiki/Changelog#release-124
    https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High