CVE-2020-12625

moderate-risk
Published 2020-05-04

An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.

Do I need to act?

~
2.3% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10 Medium
NETWORK / LOW complexity

Affected Products (7)

Affected Vendors

Debian Roundcube Opensuse

References (14)

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html
Exploit https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20...
Patch https://github.com/roundcube/roundcubemail/commit/87e4cd0cf2c550e77586860b94e5c7...
Patch https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4
Third Party Advisory https://github.com/roundcube/roundcubemail/releases/tag/1.4.4
Third Party Advisory https://security.gentoo.org/glsa/202007-41
Third Party Advisory https://www.debian.org/security/2020/dsa-4674
Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html
Exploit https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20...
Patch https://github.com/roundcube/roundcubemail/commit/87e4cd0cf2c550e77586860b94e5c7...
Patch https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4
Third Party Advisory https://github.com/roundcube/roundcubemail/releases/tag/1.4.4
Third Party Advisory https://security.gentoo.org/glsa/202007-41
Third Party Advisory https://www.debian.org/security/2020/dsa-4674
42
/ 100
moderate-risk
Severity 23/34 · High
Exploitability 5/34 · Minimal
Exposure 14/34 · Moderate