Actively exploited · Published Dec 28, 2020 · Assigned by mitre
CVE-2020-35730
Medium 6.1 Exploited
In plain English
A medium-severity cross-site scripting in Roundcube Webmail from Roundcube. Attackers are actively exploiting it in the wild (listed by CISA on June 22, 2023). The chance it is exploited in the next 30 days is estimated at 32.9% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jul 13, 2023.
Official description
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | roundcube | 1.4.10+dfsg.1-1 | DEBIAN-CVE-2020-35730 |
| Debian:13 | roundcube | 1.4.10+dfsg.1-1 | DEBIAN-CVE-2020-35730 |
| Debian:14 | roundcube | 1.4.10+dfsg.1-1 | DEBIAN-CVE-2020-35730 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://roundcube.net/download/ x_refsource_MISC
- https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10 x_refsource_CONFIRM
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491 x_refsource_CONFIRM
- https://www.alexbirnberg.com/roundcube-xss.html x_refsource_MISC
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.10 x_refsource_CONFIRM
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.16 x_refsource_CONFIRM
- https://github.com/roundcube/roundcubemail/releases/tag/1.2.13 x_refsource_CONFIRM
- FEDORA-2021-2cb0643316 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-73359af51c vendor-advisory, x_refsource_FEDORA
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-35730 government-resource