PT-2020-3640 · Roundcube+3 · Roundcube Webmail+3

Lorexxar + 1 · Published 2019-11-09 · Updated 2025-11-04 · CVE-2020-13965

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.3.12 Roundcube Webmail versions 1.4.x prior to 1.4.5

Description The issue is related to insufficient protection measures for web page structures in Roundcube Webmail, allowing a remote attacker to impact data integrity. There is a Cross-Site Scripting (XSS) vulnerability via a malicious XML attachment, as text/xml is among the allowed types for a preview.

Recommendations For versions prior to 1.3.12, update to version 1.3.12 or later. For versions 1.4.x prior to 1.4.5, update to version 1.4.5 or later. As a temporary workaround, consider restricting the allowed types for preview to exclude text/xml until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

ALT-PU-2019-3109

ALT-PU-2020-1898

ALT-PU-2020-2097

ALT-PU-2020-2319

ALT-PU-2020-2367

ALT-PU-2020-2518

ALT-PU-2020-2554

ALT-PU-2020-3561

ALT-PU-2020-3566

ALT-PU-2021-3558

ALT-PU-2022-1073

ALT-PU-2025-1825

ALT-PU-2025-8283

BDU:2020-03988

BIT-ROUNDCUBE-2020-13965

CVE-2020-13965

DSA-4700-1

MGASA-2020-0261

USN-5182-1

Affected Products

Alt Linux

Linuxmint

Roundcube Webmail

Ubuntu

References · 55

• 🔥 https://github.com/fearsoff-org/CVE-2025-49113 · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube · Exploit
• 🔥 https://github.com/s3cb0y/CVE-2023-43770-POC · Exploit
• 🔥 https://github.com/pentesttoolscom/roundcube-cve-2021-44026 · Exploit
• 🔥 https://github.com/bartfroklage/CVE-2024-37383-POC · Exploit
• 🔥 https://github.com/knight0x07/CVE-2023-43770-PoC · Exploit
• 🔥❌ https://github.com/greandfather/EXPLOIT-Roundcube-vulnerability-POC-CVE-2023-5631- · Exploit, Deleted
• https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3 · Patch
• https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5 · Patch
• https://osv.dev/vulnerability/CVE-2020-13965 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK · Vendor Advisory
• https://osv.dev/vulnerability/USN-5182-1 · Vendor Advisory