Roundcube · Webmail
CVE-2020-13965
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
공격에 악용됨
보통 6.3 공격 가능성: 77%
무엇인가
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
CISA: Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.
할 일
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
미국 연방 기관 조치 기한: 2024년 7월 17일
- CISA 목록에 추가됨
- 2024년 6월 26일
- 게시됨
- 2020년 6월 9일
- 심각도
- 보통 6.3 CVSS 3.1
- 향후 30일 내 공격 가능성(EPSS)
- 77% 알려진 모든 취약점 중 상위 0.5%
- 약점 유형
- CWE-80
- 자세히
- NVD · CVE.org · CISA
모든 참고 자료(9)
- https://www.debian.org/security/2020/dsa-4700
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMS…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QS…
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.5
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.12
- https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3
- https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5
- https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malici…
Roundcube의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2026. 2. 20. | Deserialization of Untrusted Data | Webmail | 치명적 9.9 | 99.7% |
| 2026. 2. 20. | Cross-site Scripting | Webmail | 높음 7.2 | 27% |
| 2025. 6. 9. | Cross-Site Scripting | Webmail | 치명적 9.3 | 83% |
| 2024. 10. 24. | Cross-Site Scripting (XSS) | Webmail | 보통 6.1 | 74% |
| 2024. 2. 12. | Persistent Cross-Site Scripting (XSS) | Webmail | 보통 6.1 | 64% |
| 2023. 10. 26. | Persistent Cross-Site Scripting (XSS) | Webmail | 보통 6.1 | 76% |
| 2023. 6. 22. | Webmail Remote Code Execution | Roundcube Webmail | 치명적 9.8 | 84% |
| 2023. 6. 22. | Webmail Cross-Site Scripting (XSS) | Roundcube Webmail | 보통 6.1 | 33% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.