Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
6.1
CVSSv3

CVE-2020-16145

Published: 12/08/2020 Updated: 07/11/2023
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8
VMScore: 384
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Subscribe to Roundcube

Vulnerability Summary

Roundcube Webmail prior to 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

roundcube webmail

fedoraproject fedora 31

fedoraproject fedora 32

Vendor Advisories

Debian CVElist Bug Report Logs: roundcube: CVE-2020-16145: XSS vulnerability via HTML messages with malicious svg or math content
Debian Bug report logs - #968216 roundcube: CVE-2020-16145: XSS vulnerability via HTML messages with malicious svg or math content Package: src:roundcube; Maintainer for src:roundcube is Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-listsdebiannet>; Reported by: Guilhem Moulin <guilhem@debianorg> D ...
Debian Security Advisories: DSA-4744-1 roundcube -- security update
It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, is prone to cross-site scripting vulnerabilities in handling invalid svg and math tag content For the stable distribution (buster), this problem has been fixed in version 1315+dfsg1-1~deb10u1 We recommend that you upgrade your roundcube packages For th ...

References

CWE-79https://github.com/roundcube/roundcubemail/commit/a71bf2e8d4a64ff2c83fdabc1e8cb0c045a41ef4https://github.com/roundcube/roundcubemail/releases/tag/1.4.8https://github.com/roundcube/roundcubemail/releases/tag/1.3.15https://github.com/roundcube/roundcubemail/commit/d44ca2308a96576b88d6bf27528964d4fe1a6b8b#diff-d3bb3391c79904494c60ee2ac2f33070http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DAXK3565NYK4OEZVTW6S5LEVIDQEY2E/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBLUQRIBAMEQVBO6GUZECCHJDJIWCYFU/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=968216https://nvd.nist.govhttps://www.debian.org/security/2020/dsa-4744
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322administrator privilegesCVE-2024-1579hardcodedCVE-2023-20198CVE-2024-33587CVE-2024-33449CVE-2024-4308HTML injection
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook