CVE-2020-12625: XSS
Published Apr 29, 2020
·Updated
An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcubewashtml.php because JavaScript code can occur in the CDATA of an HTML message.
Affected Software
9 affected componentsFixes available
debian/roundcube
1.3.17+dfsg.1-1~deb10u21.3.17+dfsg.1-1~deb10u31.4.14+dfsg.1-1~deb11u11.4.13+dfsg.1-1~deb11u11.6.3+dfsg-1~deb12u11.6.4+dfsg-1
debian/roundcube<=1.4.3+dfsg.1-1, <=1.2.3+dfsg.1-4+deb9u3, <=1.3.10+dfsg.1-1~deb10u1
1.2.3+dfsg.1-4+deb9u41.3.11+dfsg.1-1~deb10u11.4.4+dfsg.1-11.4.4+dfsg.1-1~bpo10+1
Roundcube Webmail<1.4.4
Debian Debian Linux=9.0
Debian Debian Linux=10.0
openSUSE Backports SLE=15.0-sp1
openSUSE Backports SLE=15.0-sp2
openSUSE Leap=15.1
openSUSE Leap=15.2
Remediation
Event History
May 4, 2020
CVE Published
via MITRE·01:57 AM
Data Sourced
via MITRE·01:57 AM
Description
Frequently Asked Questions
1
What is CVE-2020-12625?
CVE-2020-12625 is a cross-site scripting (XSS) vulnerability in Roundcube Webmail before version 1.4.4.
2
What is the severity of CVE-2020-12625?
The severity of CVE-2020-12625 is high with a severity value of 6.1.
3
How does CVE-2020-12625 affect Roundcube Webmail?
CVE-2020-12625 allows for cross-site scripting (XSS) attacks to be executed in Roundcube Webmail versions before 1.4.4.
4
How can I fix CVE-2020-12625?
To fix CVE-2020-12625, you should update Roundcube Webmail to version 1.4.4 or later.
5
Where can I find more information about CVE-2020-12625?
You can find more information about CVE-2020-12625 on the OpenSUSE security announcement and the GitHub pages provided in the references.