CVE-2020-12625

MEDIUM6.1EPSS 2.3%

roundcube - security update

發布日:2020/5/4修改日:2026/5/29

描述

An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.

受影響套件(3)

Bitnami/roundcubefrom 0, < 1.4.4
Debian/roundcubefrom 0, < 1.4.4+dfsg.1-1
Debian/roundcubefrom 0, < 1.2.3+dfsg.1-4+deb9u4

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

參考連結(8)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2020-12625
WEBhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html
WEBhttps://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube
WEBhttps://github.com/roundcube/roundcubemail/commit/87e4cd0cf2c550e77586860b94e5c75d2b7686d0
WEBhttps://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4
WEBhttps://github.com/roundcube/roundcubemail/releases/tag/1.4.4
WEBhttps://security.gentoo.org/glsa/202007-41
WEBhttps://www.debian.org/security/2020/dsa-4674