CVE-2020-35730

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkrefaddindex in rcubestring_replacer.php.

References

Affected packages

Git / github.com/roundcube/roundcubemail

Affected ranges

Type

GIT

Repo

https://github.com/roundcube/roundcubemail

Events

Introduced

Fixed

9b69cce641a8c34c7efcb34628287d4fadf7bbaf

Introduced

854aa7f35f6ed963033e2c0c4735852af7eca21b

Fixed

54bf3d0d1acba03db785d16bb53564e417c3883e

Introduced

fdbdaec9989998b2a378619273f9fb60e6ad6879

Fixed

4efec49a46a3f4aab58f606d06b669b6498a0811

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.2.13"
        },
        {
            "introduced": "1.3.0"
        },
        {
            "fixed": "1.3.16"
        },
        {
            "introduced": "1.4"
        },
        {
            "fixed": "1.4.10"
        }
    ]
}

Affected versions

0.*

0.7.4

0.8.6

0.9-rc2

1.*

1.0.0

1.0.1

1.0.10

1.0.11

1.0.12

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1-beta

1.1-rc

1.1.0

1.1.1

1.1.10

1.1.11

1.1.12

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.2-beta

1.2-rc

1.2.0

1.2.1

1.2.10

1.2.11

1.2.12

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.3-beta

1.3-rc

1.3.0

1.3.1

1.3.10

1.3.11

1.3.12

1.3.13

1.3.14

1.3.15

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.3.9

1.4-beta

1.4-rc1

1.4-rc2

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

1.5-beta

1.5-rc

1.5.0

1.5.1

1.5.10

1.5.11

1.5.12

1.5.13

1.5.14

1.5.15

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.6-beta

1.6-rc

1.6.0

1.6.1

1.6.10

1.6.11

1.6.12

1.6.13

1.6.14

1.6.15

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

1.6.9

1.7-beta

1.7-beta2

1.7-rc

1.7-rc2

1.7-rc3

1.7-rc4

1.7-rc5

1.7-rc6

v0.*

v0.1-beta2

v0.1-rc1

v0.1-rc1@582

v0.1-rc2

v0.1-rc2@900

v0.1-stable

v0.1-stable@1183

v0.1.1

v0.1.1@1258

v0.2-alpha

v0.2-alpha@1499

v0.2-beta

v0.2-beta@1877

v0.2-beta@1878

v0.2-stable

v0.2-stable@2204

v0.2.1

v0.2.1@2348

v0.2.2

v0.2.2@2481

v0.2.2@2495

v0.3-beta

v0.3-beta@2799

v0.3-rc1

v0.3-stable

v0.3-stable@2921

v0.3.1

v0.3.1@3081

v0.4-beta

v0.4-beta@3548

v0.4.1

v0.4.1@4045

v0.4.2

v0.4.2@4050

v0.5

v0.5-beta

v0.5-beta@4347

v0.5-rc

v0.5-rc@4349

v0.5.1

v0.5.1@4518

v0.5.2

v0.5.2@4679

v0.5.3

v0.5.3@4832

v0.5.4

v0.5.4@5062

v0.5.4@5065

v0.5@4408

v0.6

v0.6-beta

v0.6-rc

v0.7

v0.7-beta1

v0.7-beta2

v0.7.1

v0.7.2

v0.7.3

v0.7.4

v0.8-beta

v0.8-rc

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.9-beta

v0.9-rc

v0.9-rc2

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v0.9.4

v0.9.5

v1.*

v1.0-beta

v1.0-rc

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-35730.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "32"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "33"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    }
]