CVE-2020-35730
CVE-2020-35730
In short
Roundcube Webmail has a vulnerability where attackers can inject malicious JavaScript code into plain text emails through specially crafted links, which gets executed in the victim's browser when viewing the email.
Technical detail
XSS vulnerability in linkref_addindex function of rcube_string_replacer.php allows remote attackers to inject JavaScript via malformed link references in plain text emails; requires user to view the crafted email; results in session hijacking, credential theft, or malware distribution.
Summary generated and translated by AI from the official description.
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
n/a · n/apublic PoCs found — 1
githubgithub.com/skyllpro/CVE-2021-44026-PoC★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10https://github.com/roundcube/roundcubemail/releases/tag/1.2.13https://github.com/roundcube/roundcubemail/releases/tag/1.3.16https://github.com/roundcube/roundcubemail/releases/tag/1.4.10https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/https://roundcube.net/download/https://www.alexbirnberg.com/roundcube-xss.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-35730