CVE-2020-13965
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Jun 26, 2024
- US federal agencies must remediate it by Jul 17, 2024 (BOD 22-01)
- First attack observed 1478 days after disclosure
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Source: CISA KEV · Jan 25, 2025 Jun 26, 2024
CVSS score6.1 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NWeakness type (CWE)CWE-79, CWE-80
Vendorsdebian, fedoraproject, roundcube
Affected products
| Vendors | Product | Versions |
|---|---|---|
| roundcube | webmail | < 1.3.12 |
| debian | debian linux | 9.0 |
| fedoraproject | fedora | 31 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.