CVE-2020-12625
Fixed in a distro release EPSS 3%
An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.
Products: roundcube webmail, debian_linux, opensuse backports_sle, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | roundcube | 1.3.11+dfsg.1-1~deb10u1 |
| Debian 12 | roundcube | 1.4.4+dfsg.1-1 |
| Debian 13 | roundcube | 1.4.4+dfsg.1-1 |
| Debian 14 | roundcube | 1.4.4+dfsg.1-1 |
| Debian 9 | roundcube | 1.2.3+dfsg.1-4+deb9u4 |
| SUSE Package Hub 15 SP1 | roundcubemail | 1.3.15-bp152.4.3.1 |
| SUSE Package Hub 15 SP2 | roundcubemail | 1.3.15-bp152.4.3.1 |
| Ubuntu Pro 16.04 LTS | roundcube | 1.2~beta+dfsg.1-0ubuntu1+esm2 |
| Ubuntu Pro 18.04 LTS | roundcube | 1.3.6+dfsg.1-1ubuntu0.1~esm2 |
| Ubuntu Pro 20.04 LTS | roundcube | 1.4.3+dfsg.1-1ubuntu0.1~esm1 |
| Ubuntu Pro 20.04 LTS | roundcube | 1.4.3+dfsg.1-1ubuntu0.1~esm2 |
| Ubuntu Pro 22.04 LTS | roundcube | 1.5.0+dfsg.1-2ubuntu0.1~esm1 |
| openSUSE Leap 15.1 | roundcubemail | 1.3.15-bp152.4.3.1 |
| openSUSE Leap 15.2 | roundcubemail | 1.3.15-bp152.4.3.1 |