CVE-2020-13965

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.

References

Affected packages

Git / github.com/roundcube/roundcubemail

Affected ranges

Type

GIT

Repo

https://github.com/roundcube/roundcubemail

Events

Introduced

Fixed

7a792f8a907819e03d733b9885ac651a82b15429

Introduced

fdbdaec9989998b2a378619273f9fb60e6ad6879

Fixed

9898599d3ed504a604fd5bdc5fa0bea75129dadc

Fixed

884eb611627ef2bd5a2e20e02009ebb1eceecdc3

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.3.12"
        },
        {
            "introduced": "1.4.0"
        },
        {
            "fixed": "1.4.5"
        }
    ]
}

Affected versions

1.*

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-13965.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "31"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "32"
            }
        ]
    }
]