CVE-2020-35730

high-risk

Published 2020-12-28

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

Do I need to act?

64.8% chance of exploitation in next 30 days

EPSS score — higher than 35% of all CVEs

CISA KEV: actively exploited in the wild

On the Known Exploited Vulnerabilities catalog — federal agencies must patch

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.1/10 Medium

NETWORK / LOW complexity

Affected Products (4)

Webmail

Fedora

Debian Linux

Affected Vendors

Debian Fedoraproject Roundcube

References (19)

Issue Tracking https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491

Patch https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10

Release Notes https://github.com/roundcube/roundcubemail/releases/tag/1.2.13

Release Notes https://github.com/roundcube/roundcubemail/releases/tag/1.3.16

Release Notes https://github.com/roundcube/roundcubemail/releases/tag/1.4.10

Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Product https://roundcube.net/download/

Broken Link https://www.alexbirnberg.com/roundcube-xss.html

Issue Tracking https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491

Patch https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10

Release Notes https://github.com/roundcube/roundcubemail/releases/tag/1.2.13

Release Notes https://github.com/roundcube/roundcubemail/releases/tag/1.3.16

Release Notes https://github.com/roundcube/roundcubemail/releases/tag/1.4.10

Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Product https://roundcube.net/download/

Broken Link https://www.alexbirnberg.com/roundcube-xss.html

US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-...

/ 100

high-risk

Severity 23/34 · High

Exploitability 26/34 · High

Exposure 10/34 · Low