PT-2020-3643 · Roundcube+3 · Roundcube Webmail+3

Xudongzheng · Published 2020-04-30 · Updated 2024-03-06 · CVE-2020-12626

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.4.4

Description The issue is related to a CSRF attack that can cause an authenticated user to be logged out. This is because POST was not considered, leading to insufficient protection against cross-site request forgery. The exploitation of this issue may allow a remote attacker to cause a denial of service.

Recommendations For versions prior to 1.4.4, update to version 1.4.4 or later to resolve the issue. As a temporary workaround, consider implementing additional CSRF protection measures to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

ALT-PU-2020-1898

ALT-PU-2020-2367

BDU:2020-03991

BIT-ROUNDCUBE-2020-12626

CVE-2020-12626

DSA-4674-1

MGASA-2020-0206

USN-5182-1

Affected Products

Alt Linux

Linuxmint

Roundcube Webmail

Ubuntu

References · 39

• 🔥 https://github.com/roundcube/roundcubemail/pull/7302 · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/pentesttoolscom/roundcube-cve-2021-44026 · Exploit
• https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4 · Patch
• https://github.com/roundcube/roundcubemail/commit/9bbda422ff0b782b81de59c86994f1a5fd93f8e6 · Patch
• https://ubuntu.com/security/CVE-2021-44025 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-12626 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12626 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-12626 · Security Note
• https://ubuntu.com/security/CVE-2020-12625 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12640 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12626 · Security Note