CVE-2020-35730mediumunder attackCWE-79

CVE-2020-35730

Published · Updated

75Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 6.1epss 33%
from disclosure to weapon1574 days
Published on NVDDec 28
1st PoC+1574d
CISA KEV+906d
exploitation probability
33%top 2% of all CVEs
observed exploitation
yesCISA + VulnCheck
2 public exploit(s)
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
Action required by CISAfederal deadline: 2023-07-13

Apply updates per vendor instructions.

In short

Roundcube Webmail has a vulnerability where attackers can inject malicious JavaScript code into plain text emails through specially crafted links, which gets executed in the victim's browser when viewing the email.

Technical detail

XSS vulnerability in linkref_addindex function of rcube_string_replacer.php allows remote attackers to inject JavaScript via malformed link references in plain text emails; requires user to view the crafted email; results in session hijacking, credential theft, or malware distribution.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
n/a · n/a
public PoCs found — 2
githubgithub.com/skyllpro/CVE-2021-44026-PoC★ 0vulncheckvulncheck.com/xdb/bc7c78af2f10unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10https://github.com/roundcube/roundcubemail/releases/tag/1.2.13https://github.com/roundcube/roundcubemail/releases/tag/1.3.16https://github.com/roundcube/roundcubemail/releases/tag/1.4.10https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/https://roundcube.net/download/https://www.alexbirnberg.com/roundcube-xss.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-35730