{"id":"CVE-2020-35730","kind":"vulnerability","aliases":["CVE-2020-35730"],"related":[],"title":"An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10","description":"Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Roundcube Webmail, a web-based email client, has a cross-site scripting flaw: a plain text email containing JavaScript in a link reference is mishandled, so the script runs in the victim's browser. An attacker who gets a user to open such a message can run script in their Roundcube session and read or act on their mail.","severity":"high","cvss":6.1,"epss":null,"exploited":true,"exploited_at":"2023-06-22T00:00:00+00:00","products":[{"name":"Roundcube Roundcube Webmail","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"roundcube webmail","fixed":["1.2.13"],"affected":"< 1.2.13","ecosystem":"vendor"},{"name":"roundcube webmail","fixed":["1.3.16"],"affected":">= 1.3.0, < 1.3.16","ecosystem":"vendor"},{"name":"roundcube webmail","fixed":["1.4.10"],"affected":">= 1.4, < 1.4.10","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 32","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 33","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 9.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","package","roundcube","self-hosted","webmail"],"not_affected_if":["no-webmail-deployed","not-roundcube"],"how_to_check":null,"fix":"Apply the Roundcube update per vendor instructions; the sources do not name the fixed version.\nCISA lists this in KEV, so treat it as actively exploited.","status":"open","published_at":"2020-12-28T20:15:13+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:06:32+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:06:32Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Roundcube update per vendor instructions; the sources do not name the fixed version.\nCISA lists this in KEV, so treat it as actively exploited.","reach":"internet","impact":"medium","summary":"Roundcube Webmail, a web-based email client, has a cross-site scripting flaw: a plain text email containing JavaScript in a link reference is mishandled, so the script runs in the victim's browser. An attacker who gets a user to open such a message can run script in their Roundcube session and read or act on their mail.","category":"package","who_cares":["roundcube","self-hosted","webmail"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker script runs in victim's webmail session, reading and sending mail","analyst_note":"Find the fixed Roundcube version and vendor advisory for CVE-2020-35730 to fill fix and how_to_check; the KEV entry does not name versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-roundcube","no-webmail-deployed"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000485,"input_tokens":2844,"output_tokens":401,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2020':21A,24A '-35730':22A,25A '1.2.13':10A '1.3':11A '1.3.16':14A '1.4':16A '1.4.10':19A 'act':105B 'action':149C 'addinindex':144C 'allow':120C 'appli':150C 'attack':85B,122C 'base':53B 'browser':83B 'cisa':147C 'client':55B 'contain':67B,111C 'cross':59B,114C 'cross-sit':58B,113C 'cve':20A,23A 'debian':39A 'discov':5A 'e':129C 'e-mail':128C 'element':138C 'email':54B,66B 'exploit':41B 'fedora':36A,38A 'fedoraproject':35A,37A 'flaw':62B 'get':87B 'host':46B 'instruct':154C 'issu':3A 'javascript':68B,133C 'link':71B,136C 'linkref':143C 'linux':40A 'mail':108B,130C 'messag':94B,131C 'mishandl':74B,141C 'open':91B 'packag':42B 'per':152C 'plain':64B,126C 'rcube_string_replacer.php':146C 'read':103B 'refer':72B,137C 'requir':148C 'roundcub':7A,43B,48B,100B,109C 'roundcube':26A,27A,29A,31A,33A 'run':78B,96B 'script':61B,77B,97B,116C 'self':45B 'self-host':44B 'send':124C 'session':101B 'site':60B,115C 'text':65B,127C 'updat':151C 'user':89B 'vendor':153C 'victim':81B 'vulner':118C 'web':52B 'web-bas':51B 'webmail':8A,28A,30A,32A,34A,47B,49B,110C 'x':12A,17A 'xss':2A,117C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-12-28T20:15:13+00:00","kev":{"dateAdded":"2023-06-22","dueDate":"2023-07-13","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-35730","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730","severity":null,"published_at":"2023-06-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-35730","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35730","severity":null,"published_at":"2020-12-28T20:15:13+00:00","modified_at":"2026-06-17T03:14:12+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}