CVE-2020-12626

An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered.

References

Affected packages

Git / github.com/roundcube/roundcubemail

Affected ranges

Type

GIT

Repo

https://github.com/roundcube/roundcubemail

Events

Introduced

Fixed

aadb13e25f73d783f731a99f9b9c2ea43bb10c79

Fixed

9bbda422ff0b782b81de59c86994f1a5fd93f8e6

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.4.4"
        }
    ]
}

Affected versions

1.*

1.1-beta

1.1-rc

1.1.0

1.2-beta

1.2-rc

1.3-beta

1.4-beta

1.4-rc1

1.4-rc2

1.4.0

1.4.1

1.4.2

1.4.3

v0.*

v0.1-beta2

v1.*

v1.0-beta

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-12626.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    }
]