CVE-2020-15562

Published: 6 July 2020

An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.

Priority

Cvss 3 Severity Score

6.1

Score breakdown

Status

Package	Release	Status
roundcube Launchpad, Ubuntu, Debian	bionic	Released (1.3.6+dfsg.1-1ubuntu0.1~esm2) Available with Ubuntu Pro
	eoan	Ignored (end of life)
	focal	Released (1.4.3+dfsg.1-1ubuntu0.1~esm2) Available with Ubuntu Pro
	groovy	Not vulnerable (1.4.7+dfsg.1-1)
	hirsute	Not vulnerable (1.4.7+dfsg.1-1)
	impish	Not vulnerable (1.4.11+dfsg.1-4)
	jammy	Not vulnerable (1.5.0+dfsg.1-2)
	kinetic	Not vulnerable (1.5.0+dfsg.1-2)
	lunar	Not vulnerable (1.5.0+dfsg.1-2)
	mantic	Not vulnerable (1.5.0+dfsg.1-2)
	trusty	Does not exist
	upstream	Released (1.2.11, 1.3.14, 1.4.7)
	xenial	Not vulnerable (code not present)
	Patches: upstream: https://github.com/roundcube/roundcubemail/commit/f3d1566cf223eb04f47b6dfffcd88753f66c36ee upstream: https://github.com/roundcube/roundcubemail/commit/19502419757a976dbd55ce5a746610c5bab7896b upstream: https://github.com/roundcube/roundcubemail/commit/3e8832d029b035e3fcfb4c75839567a9580b4f82

Severity score breakdown

Parameter	Value
Base score	6.1
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Changed
Confidentiality	Low
Integrity impact	Low
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Bugs

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964355

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›