CVE-2020-16145

Name of the Vulnerable Software and Affected Versions: Roundcube Webmail versions prior to 1.3.15 Roundcube Webmail versions prior to 1.4.8

Description: The issue allows stored XSS in HTML messages during message display via a crafted SVG document. This can be exploited by a remote attacker to compromise data integrity. The problem is related to insufficient protection measures for web page structures in the Roundcube Webmail client, specifically in the wash uri function of the rcube washtml.php file.

Recommendations: For versions prior to 1.3.15, update to version 1.3.15 or later. For versions prior to 1.4.8, update to version 1.4.8 or later.