PT-2020-5797 · Roundcube+4 · Roundcube Webmail+4

Published 2020-11-23 · Updated 2025-12-17 · CVE-2020-35730

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Roundcube Webmail versions 1.2.0 through 1.2.12 Roundcube Webmail versions 1.3.x through 1.3.15 Roundcube Webmail versions 1.4.x through 1.4.9

Description: An issue was discovered in Roundcube Webmail, where the linkref addindex function in rcube string replacer.php mishandles JavaScript in a link reference element. This allows an attacker to send a plain text e-mail message that can inject JavaScript, potentially affecting data integrity. The vulnerability has been exploited in real-world attacks, including spearphishing campaigns.

Recommendations: For Roundcube Webmail versions 1.2.0 through 1.2.12, update to version 1.2.13 or later. For Roundcube Webmail versions 1.3.x through 1.3.15, update to version 1.3.16 or later. For Roundcube Webmail versions 1.4.x through 1.4.9, update to version 1.4.10 or later. As a temporary workaround, consider disabling the linkref addindex function in rcube string replacer.php until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2020-3561

ALT-PU-2020-3566

BDU:2021-01759

BIT-ROUNDCUBE-2020-35730

CVE-2020-35730

DLA-2508-1

DSA-4821-1

MGASA-2020-0481

OPENSUSE-SU-2021:0931-1

OPENSUSE-SU-2021:0942-1

OPENSUSE-SU-2021:0943-1

OPENSUSE-SU-2021:0959-1

OPENSUSE-SU-2021:0974-1

OPENSUSE-SU-2021:1014-1

OPENSUSE-SU-2021_0931-1

OPENSUSE-SU-2022:10148-1

OPENSUSE-SU-2024:11303-1

USN-5182-1

Affected Products

Alt Linux

Linuxmint

Roundcube Webmail

Suse

Ubuntu

References · 99

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube · Exploit
• 🔥 https://github.com/pentesttoolscom/roundcube-cve-2021-44026 · Exploit
• https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:11303-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-35730 · Security Note
• https://ubuntu.com/security/CVE-2020-13964 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5182-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44025 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01759 · Security Note
• https://ubuntu.com/security/CVE-2020-13965 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2 · Vendor Advisory