PT-2020-3644 · Roundcube+4 · Roundcube Webmail+4

Alecpl · Published 2019-10-03 · Updated 2025-06-23 · CVE-2020-12625

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.4.4

Description The issue is related to a cross-site scripting (XSS) vulnerability in the rcube washtml.php file of Roundcube Webmail. This vulnerability occurs because JavaScript code can be present in the CDATA of an HTML message, allowing for potential exploitation. The vulnerability may allow a remote attacker to impact data integrity.

Recommendations For versions prior to 1.4.4, update to version 1.4.4 or later to resolve the issue. As a temporary workaround, consider disabling the rcube washtml.php file until a patch is available. Restrict access to the vulnerable rcube washtml.php file to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2019-2818

ALT-PU-2019-2946

ALT-PU-2019-3109

ALT-PU-2020-1898

ALT-PU-2020-2097

ALT-PU-2020-2319

ALT-PU-2020-2367

ALT-PU-2020-2518

ALT-PU-2020-2554

ALT-PU-2020-3561

ALT-PU-2020-3566

ALT-PU-2021-3558

ALT-PU-2022-1073

ALT-PU-2025-1825

ALT-PU-2025-8283

BDU:2020-03992

BIT-ROUNDCUBE-2020-12625

CVE-2020-12625

DSA-4674-1

MGASA-2020-0206

OPENSUSE-SU-2020:1516-1

OPENSUSE-SU-2020_1516-1

USN-5182-1

Affected Products

Alt Linux

Linuxmint

Roundcube Webmail

Suse

Ubuntu

References · 60

• 🔥 https://github.com/fearsoff-org/CVE-2025-49113 · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/s3cb0y/CVE-2023-43770-POC · Exploit
• 🔥 https://github.com/pentesttoolscom/roundcube-cve-2021-44026 · Exploit
• 🔥 https://github.com/bartfroklage/CVE-2024-37383-POC · Exploit
• 🔥 https://github.com/knight0x07/CVE-2023-43770-PoC · Exploit
• 🔥❌ https://github.com/greandfather/EXPLOIT-Roundcube-vulnerability-POC-CVE-2023-5631- · Exploit, Deleted
• https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4 · Patch
• https://github.com/roundcube/roundcubemail/commit/87e4cd0cf2c550e77586860b94e5c75d2b7686d0 · Patch
• https://ubuntu.com/security/CVE-2021-44025 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-12625 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12625 · Vendor Advisory