medium5.4Public exploit code
CVE-2018-16736
In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters section of the settings).
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Roundcube rcfilters plugin 2.1.6 - Cross-Site Scripting2018-09-19 · webapps · linux
Impact
In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters section of the settings).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rcfilters Project | Rcfilters | Version 2.1.6 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/eagle00789/RC_Filters/issues/19
- https://github.com/roundcube/roundcubemail/issues/6437
- https://www.exploit-db.com/exploits/45437/
- https://github.com/eagle00789/RC_Filters/issues/19
- https://github.com/roundcube/roundcubemail/issues/6437
- https://www.exploit-db.com/exploits/45437/