Roundcube · Webmail
CVE-2020-13965
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
What it is
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
CISA: Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: July 17, 2024
- Added to the CISA list
- June 26, 2024
- Published
- June 9, 2020
- Severity
- Medium 6.3 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 77% in the top 0.5% of all known vulnerabilities
- Weakness
- CWE-80
- More details
- NVD · CVE.org · CISA
All references (9)
- https://www.debian.org/security/2020/dsa-4700
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMS…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QS…
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.5
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.12
- https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3
- https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5
- https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malici…
More exploited flaws from Roundcube
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Feb 20, 2026 | Deserialization of Untrusted Data | Webmail | Critical 9.9 | 99.7% |
| Feb 20, 2026 | Cross-site Scripting | Webmail | High 7.2 | 27% |
| Jun 9, 2025 | Cross-Site Scripting | Webmail | Critical 9.3 | 83% |
| Oct 24, 2024 | Cross-Site Scripting (XSS) | Webmail | Medium 6.1 | 74% |
| Feb 12, 2024 | Persistent Cross-Site Scripting (XSS) | Webmail | Medium 6.1 | 64% |
| Oct 26, 2023 | Persistent Cross-Site Scripting (XSS) | Webmail | Medium 6.1 | 76% |
| Jun 22, 2023 | Webmail Remote Code Execution | Roundcube Webmail | Critical 9.8 | 84% |
| Jun 22, 2023 | Webmail Cross-Site Scripting (XSS) | Roundcube Webmail | Medium 6.1 | 33% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.