CVE-2010-0464

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-01-29 · updated 2026-06-16
Weakness: CWE-200

Description

Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.

Affected products

Roundcube Webmail: through 0.3.1; 0.1, 0.1-20050811, 0.1-20050820, 0.1-20051007, 0.1-20051021, 0.1-alpha (+16)

References

http://trac.roundcube.net/ticket/1486449
http://www.mandriva.com/security/advisories?name=MDVSA-2010:048
https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail
http://trac.roundcube.net/ticket/1486449
http://www.mandriva.com/security/advisories?name=MDVSA-2010:048
https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail

Get alerted when CVE-2010-0464 or the next vulnerability affects your stack