CVE-2020-13964

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.3.12 Roundcube Webmail versions 1.4.x prior to 1.4.5

Description The issue is related to insufficient protection measures for web page structures in Roundcube Webmail, allowing a remote attacker to impact data integrity. The problem is specifically with the username template object in include/rcmail output html.php, which allows for XSS attacks.

Recommendations For Roundcube Webmail versions prior to 1.3.12, update to version 1.3.12 or later. For Roundcube Webmail versions 1.4.x prior to 1.4.5, update to version 1.4.5 or later. As a temporary workaround, consider restricting access to the include/rcmail output html.php file until a patch is available. Avoid using the username template object in the affected API endpoints until the issue is resolved.