roundcube is vulnerable to cross-site scripting (XSS). An attacker is able to inject and execute arbitrary Javascript in a user’s browser via HTML messages during message display.
CPE | Name | Operator | Version |
---|---|---|---|
roundcube:stretch | eq | 1.2.3+dfsg.1-4+deb9u6 | |
roundcube:stretch | eq | 1.2.3+dfsg.1-4+deb9u6 |
lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html
github.com/roundcube/roundcubemail/commit/a71bf2e8d4a64ff2c83fdabc1e8cb0c045a41ef4
github.com/roundcube/roundcubemail/commit/d44ca2308a96576b88d6bf27528964d4fe1a6b8b#diff-d3bb3391c79904494c60ee2ac2f33070
github.com/roundcube/roundcubemail/releases/tag/1.3.15
github.com/roundcube/roundcubemail/releases/tag/1.4.8
lists.fedoraproject.org/archives/list/[email protected]/message/3DAXK3565NYK4OEZVTW6S5LEVIDQEY2E/
lists.fedoraproject.org/archives/list/[email protected]/message/OBLUQRIBAMEQVBO6GUZECCHJDJIWCYFU/
security-tracker.debian.org/tracker/CVE-2020-16145