CVE-2020-13965

CVE Database · CVE-2020-13965

CVE-2020-13965

· MEDIUMAnalyzed

CVSS v3.1

6.1

EPSS

76.60%

Published

Jun 9, 2020

Modified

Nov 4, 2025

CISA Known Exploited Vulnerability

Added: 2024-06-26 · Due: 2024-07-17

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Public PoC / Exploit (2)

All weaponized →

TrickestTrickest PoC index GitHub PoCmbadanoiu/CVE-2020-13965★0

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79CWE-80

Affected Products (6)

roundcube · webmail (up to 1.3.12)vulnerable

roundcube · webmail (up to 1.4.5)vulnerable

debian · debian_linuxvulnerable

fedoraproject · fedoravulnerable

References (19)

https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube

ExploitThird Party Advisory

https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3

PatchThird Party Advisory

https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5

Patch

https://github.com/roundcube/roundcubemail/releases/tag/1.3.12

Release Notes

https://github.com/roundcube/roundcubemail/releases/tag/1.4.5

Release Notes

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/

KEV Catalog EPSS Scores Vendors All CVEs