The vulnerability of the linkref_addindex function in the rcube_string_replacer.php component of the Roundcube webmail client allows a attacker to compromise the integrity of data, due to deficiencies in the security measures used to protect web page structures.

🗓️ 30 Mar 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Roundcube vulnerability in linkref_addindex allows data integrity compromise due to unvalidated links.

Reporter	Title	Published	Views	Family All 91
GithubExploit	Exploit for SQL Injection in Roundcube Webmail	14 Nov 202311:32	–	githubexploit
ATTACKERKB	CVE-2020-35730	28 Dec 202000:00	–	attackerkb
ArchLinux	[ASA-202101-2] roundcubemail: cross-site scripting	4 Jan 202100:00	–	archlinux
Information Security Automation	Vulnerabilities of Western logistics	27 May 202523:55	–	avleonov
Information Security Automation	About Cross Site Scripting – MDaemon Email Server (CVE-2024-11182)	29 May 202521:46	–	avleonov
Circl	CVE-2020-35730	28 Dec 202022:28	–	circl
CISA KEV Catalog	Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability	22 Jun 202300:00	–	cisa_kev
CISA	CISA Adds Six Known Exploited Vulnerabilities to Catalog	22 Jun 202312:00	–	cisa
CNNVD	Roundcube Webmail 跨站脚本漏洞	28 Dec 202000:00	–	cnnvd
CNVD	Roundcube Webmail Cross-Site Scripting Vulnerability (CNVD-2021-44696)	29 Dec 202000:00	–	cnvd

Vulners

Node

thomas_brderli roundcubeRange<1.2.13

OR

thomas_brderli roundcubeRange1.3.0–1.3.16

OR

thomas_brderli roundcubeRange1.4.0–1.4.10

OR

fedora fedoraMatch32

OR

fedora fedoraMatch33

Source	Link
github	www.github.com/roundcube/roundcubemail/releases/tag/1.2.13
github	www.github.com/roundcube/roundcubemail/releases/tag/1.3.16
github	www.github.com/roundcube/roundcubemail/releases/tag/1.4.10
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-35730
security-tracker	www.security-tracker.debian.org/tracker/CVE-2020-35730
alexbirnberg	www.alexbirnberg.com/roundcube-xss.html
cisa	www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
web	www.web.nvd.nist.gov/view/vuln/detail

24 Sep 2024 00:00Current

7.3High risk

Vulners AI Score7.3

CVSS 24.3

CVSS 36.1

EPSS0.32823

Roundcube linkref_addindex unvalidated links data integrity