CVE-2020-13965
roundcube webmail
Published 9 Jun 2020 · updated 17 Jun 2026 · Analyzed
6.1 Medium · CVSS 3.1, NVD
Exploited in the wild
CISA added this to its Known Exploited Vulnerabilities catalog on 26 Jun 2024, with a remediation deadline of 17 Jul 2024 for US federal agencies.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
References
- github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube · Exploit, Third Party Advisory
- github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3 · Patch, Third Party Advisory
- github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5 · Patch
- github.com/roundcube/roundcubemail/releases/tag/1.3.12 · Release Notes
- github.com/roundcube/roundcubemail/releases/tag/1.4.5 · Release Notes
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/ · Mailing List
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/ · Mailing List
- roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 · Vendor Advisory
- www.debian.org/security/2020/dsa-4700 · Third Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13965 · US Government Resource