CVE-2011-1492
MEDIUM · CVSS 5.5EPSS 1.8%EU EUVD
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request.
Key facts
- CVSS score
- 5.5 (v2.0)
- Severity
- MEDIUM
- CVSS vector
AV:N/AC:L/Au:S/C:P/I:P/A:N- Weakness (CWE)
- CWE-20
- EPSS score
- 1.8% (78th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2011-1495)
- Published
- April 8, 2011
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2011-1495 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.
View on the EU Vulnerability DatabaseAffected products
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
- roundcube / webmail
References
- http://openwall.com/lists/oss-security/2011/03/24/3
- http://openwall.com/lists/oss-security/2011/03/24/4(Patch)
- http://openwall.com/lists/oss-security/2011/04/04/50(Patch)
- http://secunia.com/advisories/44050(Vendor Advisory)
- http://trac.roundcube.net/changeset/4488(Patch)
- http://trac.roundcube.net/wiki/Changelog
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66613
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain