Vulnerability · Published May 4, 2020 · Assigned by mitre
CVE-2020-12625
Medium 6.1
In plain English
A medium-severity security flaw in the roundcube package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)2.9%top 12.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | roundcube | 1.4.4+dfsg.1-1 | DEBIAN-CVE-2020-12625 |
| Debian:13 | roundcube | 1.4.4+dfsg.1-1 | DEBIAN-CVE-2020-12625 |
| Debian:14 | roundcube | 1.4.4+dfsg.1-1 | DEBIAN-CVE-2020-12625 |
Affected products (as reported)
References
- https://github.com/roundcube/roundcubemail/commit/87e4cd0cf2c550e77586860b94e5c75d2b7686d0 x_refsource_MISC
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.4 x_refsource_MISC
- https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4 x_refsource_MISC
- DSA-4674 vendor-advisory, x_refsource_DEBIAN
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube x_refsource_MISC
- GLSA-202007-41 vendor-advisory, x_refsource_GENTOO
- openSUSE-SU-2020:1516 vendor-advisory, x_refsource_SUSE