CVE-2020-16145

Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15.

References

Affected packages

Git / github.com/roundcube/roundcubemail

Affected ranges

Type

GIT

Repo

https://github.com/roundcube/roundcubemail

Events

Introduced

Fixed

e4dc3e942c79271f7e0933d91895e7fcd810ec44

Introduced

fdbdaec9989998b2a378619273f9fb60e6ad6879

Fixed

ce22759434234eaaa34aa1258e3b300fd144dd05

Fixed

a71bf2e8d4a64ff2c83fdabc1e8cb0c045a41ef4

Fixed

d44ca2308a96576b88d6bf27528964d4fe1a6b8b

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.3.15"
        },
        {
            "introduced": "1.4.0"
        },
        {
            "fixed": "1.4.8"
        }
    ]
}

Affected versions

1.*

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-16145.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "31"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "32"
            }
        ]
    }
]