CVE-2020-13964

2020-06-0900:00:00

ubuntu.com

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.056 Low

EPSS

Percentile

93.3%

JSON

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before
1.4.5. include/rcmail_output_html.php allows XSS via the username template
object.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=962123>

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchroundcube< 1.3.6+dfsg.1-1ubuntu0.1~esm2UNKNOWN
ubuntu20.04noarchroundcube< 1.4.3+dfsg.1-1ubuntu0.1~esm1UNKNOWN
ubuntu16.04noarchroundcube< 1.2~beta+dfsg.1-0ubuntu1+esm2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	roundcube	< 1.3.6+dfsg.1-1ubuntu0.1~esm2	UNKNOWN
ubuntu	20.04	noarch	roundcube	< 1.4.3+dfsg.1-1ubuntu0.1~esm1	UNKNOWN
ubuntu	16.04	noarch	roundcube	< 1.2~beta+dfsg.1-0ubuntu1+esm2	UNKNOWN