CVE-2012-4668

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-08-25 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email.

Affected products

Roundcube Webmail: through 0.8.1; 0.1, 0.1-alpha, 0.1-beta, 0.1-beta2, 0.1-rc1, 0.1-rc2 (+27)

References

http://sourceforge.net/news/?group_id=139281&id=309011
http://trac.roundcube.net/ticket/1488613
http://www.openwall.com/lists/oss-security/2012/08/20/2
http://www.openwall.com/lists/oss-security/2012/08/20/9
https://github.com/roundcube/roundcubemail/commit/c086978f6a91eacb339fd2976202fca9dad2ef32
http://sourceforge.net/news/?group_id=139281&id=309011
http://trac.roundcube.net/ticket/1488613
http://www.openwall.com/lists/oss-security/2012/08/20/2
http://www.openwall.com/lists/oss-security/2012/08/20/9
https://github.com/roundcube/roundcubemail/commit/c086978f6a91eacb339fd2976202fca9dad2ef32

Get alerted when CVE-2012-4668 or the next vulnerability affects your stack