CVE-2020-13965 : An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.

Published 2020-06-09 03:15:11

Updated 2024-08-14 20:09:54

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2020-13965

Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 31
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 32
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Matching versions
Roundcube » Webmail
Versions before (<) 1.3.12
cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
Matching versions
Roundcube » Webmail
Versions from including (>=) 1.4.0 and before (<) 1.4.5
cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
Matching versions

CVE-2020-13965 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

CISA required action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA description:

Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.

Notes:

https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12; https://nvd.nist.gov/vuln/detail/CVE-2020-13965

Added on 2024-06-26 Action due date 2024-07-17

Exploit prediction scoring system (EPSS) score for CVE-2020-13965

EPSS FAQ

0.55%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 78 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-13965

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L	2.8	3.4	134c704f-9b21-4f2e-91b3-4a467353bcc0	2024-07-03
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2020-13965

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

References for CVE-2020-13965

https://www.debian.org/security/2020/dsa-4700

Debian -- Security Information -- DSA-4700-1 roundcube
Third Party Advisory

CVEs referencing this url
https://github.com/roundcube/roundcubemail/releases/tag/1.3.12

Release Roundcube Webmail 1.3.12 · roundcube/roundcubemail · GitHub
Release Notes;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/

[SECURITY] Fedora 31 Update: roundcubemail-1.4.6-1.fc31 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url
https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5

Comparing 1.4.4...1.4.5 · roundcube/roundcubemail · GitHub
Patch;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/

[SECURITY] Fedora 32 Update: roundcubemail-1.4.6-1.fc32 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube

Disclosures/CVE-2020-13965-Cross Site-Scripting via Malicious XML Attachment-Roundcube at master · DrunkenShells/Disclosures · GitHub
Exploit;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/

[SECURITY] Fedora 32 Update: roundcubemail-1.4.6-1.fc32 - package-announce - Fedora Mailing-Lists
Mailing List
https://github.com/roundcube/roundcubemail/releases/tag/1.4.5

Release Roundcube Webmail 1.4.5 · roundcube/roundcubemail · GitHub
Release Notes;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/

[SECURITY] Fedora 31 Update: roundcubemail-1.4.6-1.fc31 - package-announce - Fedora Mailing-Lists
Mailing List
https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3

Security: Fix cross-site scripting (XSS) via malicious XML attachment · roundcube/roundcubemail@884eb61 · GitHub
Patch;Third Party Advisory
https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12

Security updates 1.4.5 and 1.3.12 released
Vendor Advisory

CVEs referencing this url