CVE-2018-19206

steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML…

published November 12, 2018

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.0th percentile for exploit probability.

CVSS
—
EPSS
56%
Percentile
99.0
In the wild
Unconfirmed
What it is

steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.55852 · 99.0th percentile
Published
2018-11-12T17:00Z
EPSS history
Timeline
  • 22 SEP 03:16Z
    EPSS moved 56% → 31%
    epss
  • 06 SEP 03:11Z
    EPSS moved 56% → 31%
    epss
  • 30 AUG 16:01Z
    EPSS moved 31% → 56%
    epss
  • 29 AUG 04:36Z
    EPSS moved 56% → 31%
    epss
  • 12 NOV 17:00Z
    steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML…
    cvelistv5