CVE-2020-18671

Name of the Vulnerable Software and Affected Versions Roundcube Mail versions prior to 1.4.5

Description The issue is related to a Cross Site Scripting (XSS) vulnerability. It is associated with the smtp config in the installer. The vulnerability may allow a remote attacker to impact data integrity.

Recommendations For versions prior to 1.4.5, update to version 1.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the /installer/test.php endpoint until a patch is available. Avoid using the smtp config in the installer until the issue is resolved.