Veille CVE
CVE-2020-13965
6.1 Moyenne Exploitée activementCatalogue CISA KEV — Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
Ajoutée le 26/06/2024 · Échéance de correction (agences US) : 17/07/2024
Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 6.1 Moyenne | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| 3.1 | 6.3 Moyenne | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
| 2.0 | 4.3 Moyenne | nvd@nist.gov (NVD) | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Faiblesses (CWE)
Références
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube ExploitThird Party Advisory
- https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3 PatchThird Party Advisory
- https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5 Patch
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.12 Release Notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.5 Release Notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/ Mailing List
- https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 Vendor Advisory
- https://www.debian.org/security/2020/dsa-4700 Third Party Advisory
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube ExploitThird Party Advisory
- https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3 PatchThird Party Advisory
- https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5 Patch
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.12 Release Notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.5 Release Notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/ Mailing List
- https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 Vendor Advisory
- https://www.debian.org/security/2020/dsa-4700 Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13965 US Government Resource