{"id":"CVE-2020-13965","kind":"vulnerability","aliases":["CVE-2020-13965"],"related":[],"title":"An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5","description":"Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Roundcube Webmail has a cross-site scripting flaw triggered by a malicious XML attachment. An attacker who gets a user to open such a message can run script in the victim's webmail session.","severity":"medium","cvss":6.3,"epss":null,"exploited":true,"exploited_at":"2024-06-26T00:00:00+00:00","products":[{"name":"roundcube webmail","fixed":["1.3.12"],"affected":"< 1.3.12","ecosystem":"vendor"},{"name":"roundcube webmail","fixed":["1.4.5"],"affected":">= 1.4.0, < 1.4.5","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 31","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 32","ecosystem":"vendor"},{"name":"Roundcube Webmail","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["email","exploited","package","roundcube","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor mitigation or upgrade Roundcube to a fixed release; the sources do not name the fixed version.","status":"open","published_at":"2020-06-09T03:15:11+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:38+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:58:38Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or upgrade Roundcube to a fixed release; the sources do not name the fixed version.","reach":"internet","impact":"medium","summary":"Roundcube Webmail has a cross-site scripting flaw triggered by a malicious XML attachment. An attacker who gets a user to open such a message can run script in the victim's webmail session.","category":"package","who_cares":["roundcube","self-hosted","email"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker script runs in victim's webmail session, reading mail and actions","analyst_note":"Find the fixed Roundcube version and the vendor mitigation text for CVE-2020-13965 (Roundcube security advisory) and confirm the affected version range.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000451,"input_tokens":2824,"output_tokens":338,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-13965':17A,20A '-2020':16A,19A '1.3.12':9A '1.4':11A '1.4.5':14A 'action':102C 'allow':88C 'appli':103C 'attach':56B,99C 'attack':58B,91C 'cisa':100C 'contain':79C 'cross':47B,82C 'cross-sit':46B,81C 'cve':15A,18A 'data':94C 'debian':25A,27A 'discontinu':109C 'discov':4A 'email':35B 'exploit':36B 'fedora':30A,32A 'fedoraproject':29A,31A 'flaw':50B 'get':60B 'host':41B 'instruct':107C 'issu':2A 'linux':26A,28A 'malici':54B,97C 'manipul':93C 'messag':67B 'mitig':104C,115C 'open':64B 'packag':37B 'per':105C 'product':113C 'remot':90C 'requir':101C 'roundcub':6A,38B,42B,77C 'roundcube':21A,23A,33A 'run':69B 'script':49B,70B,84C 'self':40B 'self-host':39B 'session':76B 'site':48B,83C 'trigger':51B 'unavail':117C 'use':110C 'user':62B 'vendor':106C 'via':95C 'victim':73B 'vulner':86C 'webmail':7A,22A,24A,34A,43B,75B,78C 'x':12A 'xml':55B,98C 'xss':85C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-06-09T03:15:11+00:00","kev":{"dateAdded":"2024-06-26","dueDate":"2024-07-17","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-13965","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-13965","severity":null,"published_at":"2024-06-26T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-13965","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13965","severity":null,"published_at":"2020-06-09T03:15:11+00:00","modified_at":"2026-06-17T02:54:01+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}