CVE-2020-13965

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.3.12 Roundcube Webmail versions 1.4.x prior to 1.4.5

Description The issue is related to insufficient protection measures for web page structures in Roundcube Webmail, allowing a remote attacker to impact data integrity. There is a Cross-Site Scripting (XSS) vulnerability via a malicious XML attachment, as text/xml is among the allowed types for a preview.

Recommendations For versions prior to 1.3.12, update to version 1.3.12 or later. For versions 1.4.x prior to 1.4.5, update to version 1.4.5 or later. As a temporary workaround, consider restricting the allowed types for preview to exclude text/xml until a patch is available.