CVE-2020-35730
Known Exploited (CISA KEV)MEDIUM
6.1
CVSS Severity Score
Vulnerability Description
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
Affected Platforms (CPE)
📦
Roundcube
Webmail
< 1.2.13📦
Roundcube
Webmail
>= 1.3.0 and < 1.3.16📦
Roundcube
Webmail
>= 1.4 and < 1.4.10💻
Fedoraproject
Fedora
= 32💻
Fedoraproject
Fedora
= 33💻
Debian