# CVE-2020-35730

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

- Page: https://www.vulneraibility.com/cve/CVE-2020-35730
- CVSS: 6.1
- Known exploited: yes, in CISA KEV since 2023-06-22; CISA due date 2023-07-13
- EPSS: 32.92% (percentile 98.4)
- Unvetted proof-of-concept code on GitHub: 1 GitHub proof of concept (first 2025-04-20)
- CISA SSVC: exploitation active, automatable no, technical impact partial (assessed 2025-02-04)
- Weakness: CWE-79
- Published: 2020-12-28

## Affected versions

- roundcube: affected < 1.2.13; >= 1.3.0 and < 1.3.16; >= 1.4.0 and < 1.4.10; fixed in 1.2.13, 1.3.16, 1.4.10 (Bitnami advisory, via OSV)

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://roundcube.net/download/
- [other] https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10
- [other] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491
- [other] https://www.alexbirnberg.com/roundcube-xss.html
- [other] https://github.com/roundcube/roundcubemail/releases/tag/1.4.10
- [other] https://github.com/roundcube/roundcubemail/releases/tag/1.3.16
- [other] https://github.com/roundcube/roundcubemail/releases/tag/1.2.13
- [advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/
- [advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-35730

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.