CVE-2020-13965: roundcube webmail +2 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2020-13965

CVSS 6.1 · Medium KEV · sudah dieksploitasi EPSS 76,6%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada roundcube webmail, debian linux +1 lainnya. Skor CVSS 3.1 6.1 (Medium) menurut NVD. Masuk katalog KEV CISA pada 26 Juni 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.

Rincian

Terbit di NVD: 9 Juni 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
EPSS (30 hari): 76,6% peluang dieksploitasi; lebih tinggi dari 99,5% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
Masuk KEV: 26 Juni 2024
Tenggat CISA: 17 Juli 2024 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
roundcube	webmail	Semua versi sebelum 1.3.12
roundcube	webmail	Versi 1.4.0 hingga sebelum 1.4.5
debian	debian linux	Versi 9.0
debian	debian linux	Versi 10.0
fedoraproject	fedora	Versi 31
fedoraproject	fedora	Versi 32

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 advisory vendor
https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3 patch · advisory pihak ketiga
https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5 patch
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13965 pemerintah AS
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicio... exploit · advisory pihak ketiga
https://www.debian.org/security/2020/dsa-4700 advisory pihak ketiga
https://github.com/roundcube/roundcubemail/releases/tag/1.3.12 release notes
https://github.com/roundcube/roundcubemail/releases/tag/1.4.5 release notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSW... mailing list
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP... mailing list

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.