6.1

CVE-2020-35730: Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

CVSS: 6.1v3.1MediumKEVAnalyzed
AliasesMGASA-2020-0481UBUNTU-CVE-2020-35730DEBIAN-CVE-2020-35730
Published 28-12-2020Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2020-35730 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in Roundcube Roundcube Webmail. It is known to be exploited: CISA lists it, first on 22-06-2023. EPSS estimates a 32.92% chance of exploitation in the next 30 days, higher than 98.3% of scored vulnerabilities.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)
EPSS score
32.92%
0%100%
High · +0.23 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 9 · Related 9
OPENSUSE-SU-2021:0931-1OPENSUSE-SU-2021:0942-1OPENSUSE-SU-2021:0943-1OPENSUSE-SU-2021:0959-1OPENSUSE-SU-2021:0974-1OPENSUSE-SU-2021:1014-1

Timeline

  1. 28-12-2020
    PublishedVulnerability first disclosed.
  2. 22-06-2023
    Added to CISA KEVRoundcube Webmail Cross-Site Scripting (XSS) Vulnerability
  3. 13-07-2023
    CISA remediation dueApply updates per vendor instructions.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

32.92%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

+0.23 pp

From 32.69% on 20-09-2026

20-09-202620-10-2026
EPSS score
32.92%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
22-06-2023
Federal due date
13-07-2023

CISA required action

Apply updates per vendor instructions. roundcube.net/news/2020/12/27/security-updates-1.4.10-1.3.16-and-1.2.13 nvd.nist.gov/vuln/detail/CVE-2020-35730

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian2 products
  • roundcube< 1.4.10+dfsg.1-1 | < 1.3.16+dfsg.1-1~deb10u1 | < 1.2.3+dfsg.1-4+deb9u8
  • debian_linuxEOL9.0
Fedoraproject1 product
Mageia1 product
  • roundcubemail< 1.3.16-1.mga7
Roundcube1 product
  • webmail< 1.2.13 | ≥ 1.3.0, < 1.3.16 | ≥ 1.4, < 1.4.10
Ubuntu1 product
  • roundcube< 1.2~beta+dfsg.1-0ubuntu1+esm2 | < 1.3.6+dfsg.1-1ubuntu0.1~esm2 | < 1.4.3+dfsg.1-1ubuntu0.1~esm2

5 vendors · 6 products

References

20 links
Show all 20 references