{"id":"CVE-2022-29360","aliases":["DLA-3435-1","EUVD-2022-33701","GHSA-7732-hchg-wr6h","UBUNTU-CVE-2022-29360"],"status":"published","title":"The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.","description":"The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01278,"percentile":0.70181,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2022-07-28T00:00:00Z","modified":"2026-10-28T02:31:13Z","affected":[{"source":"osv","ecosystem":"Debian:10","package":"rainloop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-2+deb10u1"}]}],"versions":["1.12.1-2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rainloop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rainloop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.0-3ubuntu1"]}],"products":[{"vendor":"rainloop","product":"webmail"}],"references":[{"url":"https://www.rainloop.net/changelog/","tags":["x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"https://blog.sonarsource.com/rainloop-emails-at-risk-due-to-code-flaw/","tags":["x_transferred","Exploit","Third Party Advisory","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00027.html","tags":["mailing-list","x_transferred","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29360","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7732-hchg-wr6h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29360.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-29360","tags":["report"]},{"url":"https://github.com/RainLoop/rainloop-webmail/issues/2142","tags":["report"]},{"url":"https://salsa.debian.org/js-team/rainloop/-/merge_requests/4","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29360","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-29360","description":"The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.","status":"published","published":"2022-07-28T00:00:00Z","modified":"2024-08-03T06:17:54.976Z","updated_at":"2026-11-02T14:34:36.270817Z"}],"euvd":[{"id":"EUVD-2022-33701","description":"The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.","status":"published","published":"2022-07-28T00:00:00Z","modified":"2024-08-03T06:17:54Z","updated_at":"2026-11-03T03:25:38.703076Z"}],"ghsa":[{"id":"GHSA-7732-hchg-wr6h","title":"The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.","description":"The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.","status":"published","published":"2022-07-29T00:00:18Z","modified":"2023-05-28T03:30:16Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:54:37.218716Z"}],"nvd":[{"id":"CVE-2022-29360","description":"The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.","status":"published","published":"2022-07-28T21:15:08.14Z","modified":"2026-06-17T04:40:04.11Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:24.037422Z"}],"osv":[{"id":"UBUNTU-CVE-2022-29360","description":"The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.","status":"published","published":"2022-07-28T21:15:00Z","modified":"2025-10-24T04:53:39Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"CVE-2022-29360","description":"The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.","status":"published","published":"2022-07-28T00:00:00Z","modified":"2026-10-28T02:31:13.719295092Z","updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"DLA-3435-1","title":"rainloop - security update","status":"published","published":"2023-05-28T00:00:00Z","modified":"2026-03-09T01:22:04.792898Z","updated_at":"2026-11-02T15:46:11.734021Z"}]}}