CVE-2020-13965

🗓️ 09 Jun 2020 02:45:24Reported by mitreType

cve🔗 web.nvd.nist.gov👁 214 Views🌐 WEB

An XSS vulnerability in Roundcube Webmail allows remote attackers to execute malicious code via a crafted XML attachment

Reporter	Title	Published	Views	Family All 51
ATTACKERKB	CVE-2020-13965	9 Jun 202000:00	–	attackerkb
GithubExploit	Exploit for Cross-site Scripting in Roundcube Webmail	13 Feb 202513:56	–	githubexploit
Circl	CVE-2020-13965	26 Jun 202418:10	–	circl
CISA KEV Catalog	Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability	26 Jun 202400:00	–	cisa_kev
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	26 Jun 202412:00	–	cisa
CNVD	Roundcube Webmail Cross-Site Scripting Vulnerability (CNVD-2020-36520)	10 Jun 202000:00	–	cnvd
Cvelist	CVE-2020-13965	9 Jun 202002:45	–	cvelist
Debian	[SECURITY] [DSA 4700-1] roundcube security update	11 Jun 202006:20	–	debian
Debian	[SECURITY] [DSA 4700-1] roundcube security update	11 Jun 202006:20	–	debian
Debian CVE	CVE-2020-13965	9 Jun 202002:45	–	debiancve

NVD

Vulnrichment

Node

roundcube webmailRange1.4.0–1.4.5

Node

Node

Source	Link
debian	www.debian.org/security/2020/dsa-4700
github	www.github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/
roundcube	www.roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/
github	www.github.com/roundcube/roundcubemail/releases/tag/1.3.12
github	www.github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5
github	www.github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3
github	www.github.com/roundcube/roundcubemail/releases/tag/1.4.5
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
_task	query param	/?_task=mail&_mbox=INBOX&_uid=[UID]&_part=2&_download=0&_action=get	XSS via malicious XML attachment download endpoint	CWE-79, CWE-80
_mbox	query param	/?_task=mail&_mbox=INBOX&_uid=[UID]&_part=2&_download=0&_action=get	XSS via malicious XML attachment download endpoint	CWE-79, CWE-80
_uid	query param	/?_task=mail&_mbox=INBOX&_uid=[UID]&_part=2&_download=0&_action=get	XSS via malicious XML attachment download endpoint	CWE-79, CWE-80
_part	query param	/?_task=mail&_mbox=INBOX&_uid=[UID]&_part=2&_download=0&_action=get	XSS via malicious XML attachment download endpoint	CWE-79, CWE-80
_download	query param	/?_task=mail&_mbox=INBOX&_uid=[UID]&_part=2&_download=0&_action=get	XSS via malicious XML attachment download endpoint	CWE-79, CWE-80
_action	query param	/?_task=mail&_mbox=INBOX&_uid=[UID]&_part=2&_download=0&_action=get	XSS via malicious XML attachment download endpoint	CWE-79, CWE-80

04 Nov 2025 15:00Current

7High risk

Vulners AI Score7

CVSS 24.3

CVSS 3.16.1 - 6.3

EPSS0.71819

SSVC