Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Roundcube Webmail steps/utils/modcss.inc任意邮件中转漏洞
Vulnerability Description
RoundCube Webmail是一款基于浏览器的IMAP客户端（邮件客户端），它支持地址薄管理、信息搜索、拼写检查等。 Roundcube Webmail 0.5.1之前版本中的steps/utils/modcss.inc没有正确验证对外部层叠样式表（CSS）的请求。远程认证用户可以借助特制请求，使用受影响系统作为邮件中转，从服务器触发任意越界TCP连接，并可能获取敏感信息。
CVSS Information
N/A
Vulnerability Type
N/A