CVE-2020-35730 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	6.1 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
mitre	CNA	---				---
CVE	ADP	---				---
CISA-ADP	ADP	6.1 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 98%

Vendor	Product	Version
roundcube	webmail	𝑥 < 1.2.13
roundcube	webmail	1.3.0 ≤ 𝑥 < 1.3.16
roundcube	webmail	1.4 ≤ 𝑥 < 1.4.10
debian	debian_linux	9.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

roundcube

bullseye (security)	1.4.15+dfsg.1-1+deb11u4 fixed
bullseye	1.4.15+dfsg.1-1+deb11u4 fixed
bookworm	1.6.5+dfsg-1+deb12u4 fixed
bookworm (security)	1.6.5+dfsg-1+deb12u4 fixed
sid	1.6.9+dfsg-1 fixed
trixie	1.6.9+dfsg-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

roundcube

noble	not-affected
mantic	not-affected
lunar	not-affected
kinetic	not-affected
jammy	not-affected
impish	not-affected
hirsute	not-affected
groovy	ignored
focal	Fixed 1.4.3+dfsg.1-1ubuntu0.1~esm2 released
bionic	Fixed 1.3.6+dfsg.1-1ubuntu0.1~esm2 released
xenial	Fixed 1.2~beta+dfsg.1-0ubuntu1+esm2 released
trusty	dne

Common Weakness Enumeration

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Vulnerability Media Exposure

[ENGLISH] Russian Hackers Exploit Email and VPN Vulnerabilities to Spy on Ukraine Aid Logistics
Russian cyber threat actors have been attributed to a state-sponsored campaign targeting Western logistics entities and technology companies since 2022. The activity has been assessed to be orchestrated by APT28 (aka BlueDelta, Fancy Bear, or Forest Blizzard), which is linked to the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center, Military Unit 26165.
Published: 2025-05-21T23:36:00+05:30

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491

https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10

https://github.com/roundcube/roundcubemail/releases/tag/1.2.13

https://github.com/roundcube/roundcubemail/releases/tag/1.3.16

https://github.com/roundcube/roundcubemail/releases/tag/1.4.10

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/

https://roundcube.net/download/

https://www.alexbirnberg.com/roundcube-xss.html

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491

https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10

https://github.com/roundcube/roundcubemail/releases/tag/1.2.13

https://github.com/roundcube/roundcubemail/releases/tag/1.3.16

https://github.com/roundcube/roundcubemail/releases/tag/1.4.10

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/

https://roundcube.net/download/

https://www.alexbirnberg.com/roundcube-xss.html