中危
Roundcube Webmail跨站脚本漏洞(CVE-2020-13965)
2020-06-09 02:45:24 公开 ，2026-02-23 18:51:42 更新
- CISA KEV
- 关键漏洞
- 远程
- 无需认证
- CWE Top 25 (2023)
- 开源组件漏洞
- CWE Top 25 (2024)
- 公开PoC
风险信息
- CVSS v2 向量
- AV:N/AC:M/Au:N/C:N/I:P/A:N
- CVSS v2 风险值
- 4.3
- CVSS v3 向量
- AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v3 风险值
- 6.1
- CVSS v3.1 向量
- AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v3.1 风险值
- 6.1
详细信息
- 漏洞类型
- 跨站脚本
- 漏洞描述
- Roundcube Webmail是一款基于浏览器的开源IMAP客户端，它支持地址薄管理、信息搜索、拼写检查等。Roundcube Webmail 1.3.12之前版本和1.4.5之前的1.4.x版本存在安全漏洞，因为text/XML是允许预览的类型之一，攻击者通过恶意XML附件可造成跨站脚本攻击。
- 修复建议
- 目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3
参考链接
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube
OSV · x_refsource_MISC
- https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3
OSV · x_refsource_MISC
- https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5
OSV · x_refsource_MISC
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.12
OSV · x_refsource_MISC
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.5
OSV · x_refsource_MISC
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/
OSV · vendor-advisory · x_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/
OSV · vendor-advisory · x_refsource_FEDORA
- https://osv.dev/vulnerability/BIT-roundcube-2020-13965
OSV
- https://osv.dev/vulnerability/CVE-2020-13965
OSV
- https://osv.dev/vulnerability/DSA-4700-1
OSV
- https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12
OSV · x_refsource_CONFIRM
- https://www.debian.org/security/2020/dsa-4700
OSV · vendor-advisory · x_refsource_DEBIAN
- https://security-tracker.debian.org/tracker/CVE-2020-13965
OSV
- https://ubuntu.com/security/CVE-2020-13965
OSV
- https://ubuntu.com/security/notices/USN-5182-1
OSV
- https://www.cve.org/CVERecord?id=CVE-2020-13965
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
OSV
- https://osv.dev/vulnerability/UBUNTU-CVE-2020-13965
OSV
- https://osv.dev/vulnerability/DEBIAN-CVE-2020-13965
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13965
NVD · US Government Resource