CVE-2020-15562
06.07.2020, 12:15
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.
| Vendor | Product | Version |
|---|---|---|
| roundcube | webmail | 𝑥 < 1.2.11 |
| roundcube | webmail | 1.3.0 ≤ 𝑥 < 1.3.14 |
| roundcube | webmail | 1.4.0 ≤ 𝑥 < 1.4.7 |
| debian | debian_linux | 10.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| roundcube |
|
References