CVE-2020-15562 — Vulnetix

CVE-2020-15562 PUBLISHED

An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.

EPSS 0.86% · 75.4th percentile

Risk Scores

EPSS Score

0.86%

75.4th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:Pro:20.04:LTS	roundcube	*, 1.3.10+dfsg.1-1, 1.4.1+dfsg.1-2
Ubuntu:Pro:18.04:LTS	roundcube	1.3.1+dfsg.1-1, 1.3.3+dfsg.1-1, 1.3.3+dfsg.1-2

Exploit Intelligence

https://github.com/roundcube/roundcubemail/releases/tag/1.4.7 (circl)
https://github.com/roundcube/roundcubemail/releases/tag/1.3.14 (circl)
https://github.com/roundcube/roundcubemail/releases/tag/1.2.11 (circl)
https://github.com/roundcube/roundcubemail/commit/3e8832d029b035e3fcfb4c75839567a9580b4f82 (circl)
DSA-4720 (circl)
openSUSE-SU-2020:1516 (circl)
roundcube.yml (github-poc)
roundcube.yml (github-poc)
roundcube.yml (github-poc)
roundcube.yml (github-poc)

…and 2 more exploits

Timeline

Jul 6, 2020 CVE Published
Apr 14, 2021 EPSS Score
Jun 23, 2021 EPSS Score
Aug 24, 2021 EPSS Score
Dec 27, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Feb 28, 2022 EPSS Score
Apr 1, 2022 EPSS Score
May 1, 2022 EPSS Score
Sep 4, 2022 EPSS Score
Nov 6, 2022 EPSS Score

References

https://ubuntu.com/security/CVE-2020-15562 third-party-advisory
https://github.com/roundcube/roundcubemail/commit/3e8832d029b035e3fcfb4c75839567a9580b4f82 third-party-advisory
https://github.com/roundcube/roundcubemail/releases/tag/1.2.11 third-party-advisory
https://github.com/roundcube/roundcubemail/releases/tag/1.3.14 third-party-advisory
https://github.com/roundcube/roundcubemail/releases/tag/1.4.7 third-party-advisory
https://ubuntu.com/security/notices/USN-5182-1 vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2020-15562 third-party-advisory

Open in Interactive Console →