CVE-2020-13965: Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

Q: What is CVE-2020-13965?

CVE-2020-13965 is a vulnerability in Roundcube Webmail that allows for cross-site scripting (XSS) attacks via a malicious XML attachment.

Q: How can I exploit CVE-2020-13965?

To exploit CVE-2020-13965, an attacker would need to send a specially crafted XML attachment to a Roundcube Webmail user and trick them into opening it.

Q: What is the severity of CVE-2020-13965?

The severity of CVE-2020-13965 is high, with a CVSS score of 6.1.

Q: How can I fix CVE-2020-13965?

To fix CVE-2020-13965, users should update Roundcube Webmail to version 1.3.12 or 1.4.5, which contain the necessary security patches.

Q: Where can I find more information about CVE-2020-13965?

More information about CVE-2020-13965 can be found on the Roundcube Webmail GitHub page and the associated CVE tracking website.

Published Jun 3, 2020

Updated

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.

Other sources

Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.

— CISA

Affected Software

9 affected componentsFixes available

debian/roundcube

1.3.17+dfsg.1-1~deb10u21.3.17+dfsg.1-1~deb10u31.4.14+dfsg.1-1~deb11u11.4.13+dfsg.1-1~deb11u11.6.3+dfsg-1~deb12u11.6.4+dfsg-1

debian/roundcube<=1.2.3+dfsg.1-4+deb9u4, <=1.4.4+dfsg.1-1, <=1.3.11+dfsg.1-1~deb10u1

1.4.5+dfsg.1-1~bpo10+11.2.3+dfsg.1-4+deb9u51.4.5+dfsg.1-11.3.13+dfsg.1-1~deb10u1

Roundcube Webmail

Roundcube Webmail<1.3.12

Roundcube Webmail>=1.4.0<1.4.5

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Fedoraproject Fedora=31

Fedoraproject Fedora=32

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/roundcube to a version that resolves this vulnerability.
Fixed in 1.3.17+dfsg.1-1~deb10u2Fixed in 1.3.17+dfsg.1-1~deb10u3Fixed in 1.4.14+dfsg.1-1~deb11u1Fixed in 1.4.13+dfsg.1-1~deb11u1Fixed in 1.6.3+dfsg-1~deb12u1Fixed in 1.6.4+dfsg-1
Upgrade
Upgrade debian/roundcube to a version that resolves this vulnerability.
Fixed in 1.4.5+dfsg.1-1~bpo10+1Fixed in 1.2.3+dfsg.1-4+deb9u5Fixed in 1.4.5+dfsg.1-1Fixed in 1.3.13+dfsg.1-1~deb10u1
Upgrade
Upgrade Roundcube Webmail to a version that resolves this vulnerability.
Fixed in 1.3.12
Upgrade
Upgrade Roundcube Webmail to a version that resolves this vulnerability.
Fixed in 1.4.5
Configuration
Remove/disable 'text/xml' from the list of allowed content types for preview so that malicious XML attachments are not rendered in preview.
Roundcube Webmail allowed preview MIME types = exclude text/xml

Event History

Jun 9, 2020

CVE Published

via MITRE·02:45 AM

Data Sourced

via MITRE·02:45 AM

Description

Jun 26, 2024

Known Exploited

via CISA·12:00 AM

Data Sourced

via CISA·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

What is CVE-2020-13965?

CVE-2020-13965 is a vulnerability in Roundcube Webmail that allows for cross-site scripting (XSS) attacks via a malicious XML attachment.

How can I exploit CVE-2020-13965?

To exploit CVE-2020-13965, an attacker would need to send a specially crafted XML attachment to a Roundcube Webmail user and trick them into opening it.

What is the severity of CVE-2020-13965?