CVE-2020-12625

MEDIO 6.1CVE-2020-12625 · Published 04/05/2020 · updated 17/06/2026

In breve

CVE-2020-12625 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda backports sle (opensuse), webmail (roundcube).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.9%, superiore al 87.1% delle vulnerabilità.
Correzione: aggiornare a 1.4.4 o successiva.

Package	Affected versions	Patched versions
backports sle opensuse	`= 15.0`	No fix yet
webmail roundcube	`< 1.4.4`	`1.4.4`

Description

An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.

References

lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html · Third Party Advisory
DrunkenShells/Disclosures · Exploit
roundcube/roundcubemail commit 87e4cd0 · Patch
roundcube/roundcubemail · Patch
roundcube/roundcubemail release 1.4.4 · Third Party Advisory
security.gentoo.org/glsa/202007-41 · Third Party Advisory
debian.org/security/2020/dsa-4674 · Third Party Advisory

Altre vulnerabilità di backports sle

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

backports sle

opensuse

= 15.0

No fix yet

webmail

roundcube

< 1.4.4

1.4.4

Altre vulnerabilità di backports sle

Vedi tutto →