CVE:CVE-2011-1491
CNNVD:CNNVD-201104-047
RoundCube Webmail是一款基于浏览器的IMAP客户端（邮件客户端），它支持地址薄管理、信息搜索、拼写检查等。
Roundcube Webmail 0.5.1之前版本中的登录表单没有正确处理认证，而是进行了意外的登陆尝试。远程认证用户可以通过安排受害者登录攻击者的账户并构成电子邮件信息，从而获取敏感信息。该漏洞与“登录CSRF”问题有关。
solution:Upgrade roundcube webmail to a higher version than 0.5,0.1,0.1:alpha,0.1:beta,0.1:beta2,0.1:rc1,0.1:rc2,0.1.1,0.2,0.2:alpha,0.2:beta,0.2.1,0.3,0.3:beta,0.3:rc1,0.3.1,0.4,0.4:beta,0.4.1,0.4.2,0.5:beta,0.5:rc,and avoid the version (,0.5],0.1,0.1:alpha,0.1:beta,0.1:beta2,0.1:rc1,0.1:rc2,0.1.1,0.2,0.2:alpha,0.2:beta,0.2.1,0.3,0.3:beta,0.3:rc1,0.3.1,0.4,0.4:beta,0.4.1,0.4.2,0.5:beta,0.5:rc