Unrated severityNVD Advisory· Published Sep 21, 2011· Updated Apr 29, 2026
CVE-2011-2937
CVE-2011-2937
Description
Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
Affected products
25cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*+ 24 more
- cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*range: <=0.5.3
- cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*
- cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
10- trac.roundcube.net/changeset/5037nvdPatch
- trac.roundcube.net/ticket/1488030nvdExploitPatch
- bugzilla.redhat.com/show_bug.cginvdExploitPatch
- lists.apple.com/archives/security-announce/2012/Feb/msg00000.htmlnvd
- sourceforge.net/news/nvd
- support.apple.com/kb/HT5130nvd
- trac.roundcube.net/browser/tags/roundcubemail/v0.5.4/CHANGELOGnvd
- www.openwall.com/lists/oss-security/2011/08/18/5nvd
- www.openwall.com/lists/oss-security/2011/08/19/15nvd
- www.securityfocus.com/bid/49229nvd
News mentions
0No linked articles in our index yet.