جزئیات آسیب‌پذیری

خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

• https://roundcube.net/download/ x_refsource_MISC
• https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10 x_refsource_CONFIRM
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491 x_refsource_CONFIRM
• https://www.alexbirnberg.com/roundcube-xss.html x_refsource_MISC
• https://github.com/roundcube/roundcubemail/releases/tag/1.4.10 x_refsource_CONFIRM
• https://github.com/roundcube/roundcubemail/releases/tag/1.3.16 x_refsource_CONFIRM
• https://github.com/roundcube/roundcubemail/releases/tag/1.2.13 x_refsource_CONFIRM
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/ vendor-advisoryx_refsource_FEDORA
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/ vendor-advisoryx_refsource_FEDORA
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-35730 government-resource