CVE-2020-13965: Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
Vulnerability summary
CVE-2020-13965 is a medium (CVSS 6.3) Cross-site Scripting vulnerability in Roundcube Webmail. It is known to be exploited: CISA lists it, first on 26-06-2024. EPSS estimates a 76.60% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 1Timeline
- 09-06-2020PublishedVulnerability first disclosed.
- 26-06-2024Added to CISA KEVRoundcube Webmail Cross-Site Scripting (XSS) Vulnerability
- 17-07-2024CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 21-10-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
76.60%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 76.60% on 21-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 26-06-2024
- Federal due date
- 17-07-2024
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 nvd.nist.gov/vuln/detail/CVE-2020-13965
Public exploits
1 foundDisclosures
Maturity: poc
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Affected systems
Debian2 products
- roundcube< 1.4.5+dfsg.1-1
- debian_linuxEOL9.0 | 10.0
Fedoraproject1 product
- fedoraEOL31 | 32
Roundcube1 product
- webmail< 1.3.12 | ≥ 1.4.0, < 1.4.5
Ubuntu1 product
- roundcube< 1.2~beta+dfsg.1-0ubuntu1+esm2 | < 1.3.6+dfsg.1-1ubuntu0.1~esm2 | < 1.4.3+dfsg.1-1ubuntu0.1~esm1
4 vendors · 5 products
References
15 links- github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3X Refsource MISCREPORTPatchThird Party Advisory
- roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12X Refsource CONFIRMREPORTVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13965Government ResourceUS Government Resource