CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: Jul 13, 2023

High

CISA KEV

CVE-2020-35730

Roundcube—Roundcube Webmail

Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.

Required Action

https://roundcube.net/news/2020/12/27/security-updates-1.4.10-1.3.16-and-1.2.13; https://nvd.nist.gov/vuln/detail/CVE-2020-35730

Vulnerability Overview

Severity: High
CISA KEV: Yes
Ransomware: Unknown
Published: Jun 22, 2023
KEV Added: Jun 22, 2023
Due Date: Jul 13, 2023
Related Articles: 0

Vendor

Roundcube

Roundcube Webmail