Patchwire CVEs, their patch status, and feeds to follow them

CVE-2020-13965

Fixed in a distro release ExploitedEPSS 77%CVSS 6.3

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.

Published 2020-06-09 · In CISA KEV since 2024-06-26 · CVE record · OSV

Products: roundcube webmail

Distro releases

ReleasePackageFixed in
Debian 10roundcube1.3.13+dfsg.1-1~deb10u1
Debian 12roundcube1.4.5+dfsg.1-1
Debian 13roundcube1.4.5+dfsg.1-1
Debian 14roundcube1.4.5+dfsg.1-1
Debian 9roundcube1.2.3+dfsg.1-4+deb9u5
Ubuntu Pro 16.04 LTSroundcube1.2~beta+dfsg.1-0ubuntu1+esm2
Ubuntu Pro 18.04 LTSroundcube1.3.6+dfsg.1-1ubuntu0.1~esm2
Ubuntu Pro 20.04 LTSroundcube1.4.3+dfsg.1-1ubuntu0.1~esm1
Ubuntu Pro 20.04 LTSroundcube1.4.3+dfsg.1-1ubuntu0.1~esm2
Ubuntu Pro 22.04 LTSroundcube1.5.0+dfsg.1-2ubuntu0.1~esm1