An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5182-1 advisory.

    It was discovered that Roundcube Webmail allowed JavaScript code to be present in the CDATA of an HTML     message. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack.
    This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12625)

    It was discovered that Roundcube Webmail incorrectly processed login and logout POST requests. An attacker     could possibly use this issue to launch a cross-site request forgery (CSRF) attack and force an     authenticated user to be logged out. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and     Ubuntu 20.04 ESM. (CVE-2020-12626)

    It was discovered that Roundcube Webmail incorrectly processed new plugin names in rcube_plugin_api.php.
    An attacker could possibly use this issue to obtain sensitive information from local files or to execute     arbitrary code. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.
    (CVE-2020-12640)

    It was discovered that Roundcube Webmail did not sanitize shell metacharacters recovered from variables in     its configuration settings. An attacker could possibly use this issue to execute arbitrary code in the     server. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12641)

    It was discovered that Roundcube Webmail incorrectly sanitized characters in the username template object.
    An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only     affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-13964)

    It was discovered that Roundcube Webmail allowed preview of text/html content. A remote attacker could     possibly use this issue to send a malicious XML attachment via an email message and execute a cross-site     scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.
    (CVE-2020-13965)

    Andrea Cardaci discovered that Roundcube Webmail did not properly sanitize HTML special characters when     dealing with HTML messages that contained an SVG element in the XML namespace. A remote attacker could     possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu     18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-15562)

    Lukasz Pilorz discovered that Roundcube Webmail did not properly sanitize HTML special characters when     dealing with HTML messages that contained SVG documents. A remote attacker could possibly use this issue     to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04     ESM. (CVE-2020-16145)

    Alex Birnberg discovered that Roundcube Webmail incorrectly sanitized characters in plain text e-mail     messages that included link reference elements. A remote attacker could possibly use this issue to execute     a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and     Ubuntu 20.04 ESM. (CVE-2020-35730)

    It was discovered that Roundcube Webmail did not properly sanitize HTML special characters in warning     messages that contained an attachment's filename extension. A remote attacker could possibly use this     issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu     18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-44025)

    It was discovered that Roundcube Webmail incorrectly managed session variables related to search     functionalities. A remote attacker could possibly use this issue to execute a SQL injection attack. This     issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-44026)

    It was discovered that Roundcube Webmail did not properly sanitize HTML special characters when dealing     with HTML messages that contained CSS content. A remote attacker could possibly use this issue to execute     a cross-site scripting (XSS) attack. This issue only affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM and     Ubuntu 22.04 ESM. (CVE-2021-46144)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10148-1 advisory.

  - In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap     them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using     HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the     intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the     plaintext of the encrypted message part(s) back to the attacker. (CVE-2019-10740)

  - rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell     metacharacters in a configuration setting for im_convert_path or im_identify_path. (CVE-2020-12641)

  - Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a     crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15. (CVE-2020-16145)

  - An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before     1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element     that is mishandled by linkref_addindex in rcube_string_replacer.php. (CVE-2020-35730)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:0931-1 advisory.

  - Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in     /installer/test.php. (CVE-2020-18670)

  - Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
    (CVE-2020-18671)

  - An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before     1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element     that is mishandled by linkref_addindex in rcube_string_replacer.php. (CVE-2020-35730)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-2cb0643316 advisory.

  - An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before     1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element     that is mishandled by linkref_addindex in rcube_string_replacer.php. (CVE-2020-35730)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-73359af51c advisory.

  - An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before     1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element     that is mishandled by linkref_addindex in rcube_string_replacer.php. (CVE-2020-35730)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An issue was discovered in roundcube where in a cross-site scripting (XSS) via HTML or plain text messages with malicious content was possible.

For Debian 9 stretch, this problem has been fixed in version 1.2.3+dfsg.1-4+deb9u8.

We recommend that you upgrade your roundcube packages.

For the detailed security status of roundcube please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/roundcube

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Alex Birnberg discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, is prone to a cross-site scripting vulnerability in handling HTML or Plain text messages with malicious content.

ID	Name	Product	Family	Severity
183111	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : Roundcube Webmail vulnerabilities (USN-5182-1)	Nessus	Ubuntu Local Security Checks	critical
166198	openSUSE 15 Security Update : roundcubemail (openSUSE-SU-2022:10148-1)	Nessus	SuSE Local Security Checks	critical
151064	openSUSE 15 Security Update : roundcubemail (openSUSE-SU-2021:0931-1)	Nessus	SuSE Local Security Checks	medium
144920	Fedora 32 : roundcubemail (2021-2cb0643316)	Nessus	Fedora Local Security Checks	medium
144918	Fedora 33 : roundcubemail (2021-73359af51c)	Nessus	Fedora Local Security Checks	medium
144627	Debian DLA-2508-1 : roundcube security update	Nessus	Debian Local Security Checks	medium
144624	Debian DSA-4821-1 : roundcube - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-35730

medium

Tenable Plugins

critical

critical

medium

medium

medium

medium

medium