Roundcube · Roundcube Webmail
CVE-2020-35730
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
O que é
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
CISA: Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.
O que fazer
Apply updates per vendor instructions.
Prazo para as agências federais dos EUA: 13 de julho de 2023
- Adicionada à lista da CISA
- 22 de junho de 2023
- Publicada
- 28 de dezembro de 2020
- Gravidade
- Média 6,1 CVSS 3.1
- Chance de ataques nos próximos 30 dias (EPSS)
- 33% entre os 1,7% mais altos de todas as vulnerabilidades conhecidas
- Fraqueza
- CWE-79
- Mais detalhes
- NVD · CVE.org · CISA
Todas as referências (9)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCL…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGID…
- https://roundcube.net/download/
- https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491
- https://www.alexbirnberg.com/roundcube-xss.html
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.10
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.16
- https://github.com/roundcube/roundcubemail/releases/tag/1.2.13
Mais falhas exploradas de Roundcube
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 22 de jun. de 2023 | Webmail Remote Code Execution | Roundcube Webmail | Crítica 9,8 | 84% |
| 22 de jun. de 2023 | Webmail SQL Injection | Roundcube Webmail | Crítica 9,8 | 70% |
| 3 de nov. de 2021 | Webmail File Disclosure | Roundcube Webmail | Alto 7,8 | 46% |
| 20 de fev. de 2026 | Deserialization of Untrusted Data | Webmail | Crítica 9,9 | 99,7% |
| 20 de fev. de 2026 | Cross-site Scripting | Webmail | Alto 7,2 | 27% |
| 9 de jun. de 2025 | Cross-Site Scripting | Webmail | Crítica 9,3 | 83% |
| 24 de out. de 2024 | Cross-Site Scripting (XSS) | Webmail | Média 6,1 | 74% |
| 26 de jun. de 2024 | Cross-Site Scripting (XSS) | Webmail | Média 6,3 | 77% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.