CVE-2020-13965
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
Description
CVE-2020-13965 is a medium-severity cross-site scripting (XSS) vulnerability in Roundcube Webmail affecting versions before 1.3.12 and 1.4.x before 1.4.5. The flaw exists because Roundcube allows text/xml as a permitted MIME type for attachment preview, enabling an attacker to embed malicious JavaScript within a crafted XML attachment that executes in the victim's browser. With a CVSS v3.1 score of 6.1 and an EPSS score of 82.69% at the 99.2nd percentile, this vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of July 17, 2024, reflecting its sustained exploitation years after disclosure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| roundcube | webmail | < 1.3.12; >= 1.4.0, < 1.4.5 |
| debian | debian linux | 9.0; 10.0 |
| fedoraproject | fedora | 31; 32 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
References
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube(Exploit, Third Party Advisory)
- https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3(Patch, Third Party Advisory)
- https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5(Patch)
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.12(Release Notes)
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.5(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/(Mailing List)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/(Mailing List)
- https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12(Vendor Advisory)
- https://www.debian.org/security/2020/dsa-4700(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13965(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2020-13965. However, this vulnerability is a textbook stored cross-site scripting (XSS) flaw, which typically corresponds to CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause is Roundcube's inclusion of text/xml in the list of MIME types permitted for inline preview rendering. When a user previews a malicious XML attachment, the browser interprets embedded JavaScript or event handlers within the XML, executing arbitrary script code in the context of the Roundcube session.
Impact Analysis
CVE-2020-13965 is a network-delivered attack (AV:N) with low complexity (AC:L) that requires no authentication (PR:N) but does need user interaction (UI:R) in the form of previewing a malicious XML attachment. The Scope is Changed (S:C), meaning the vulnerability in Roundcube can impact resources beyond its own security context, such as the user's browser session and cookies from other domains. Confidentiality (Low): the attacker can steal session cookies, read email content displayed in the browser, and exfiltrate sensitive information visible in the Roundcube interface. Integrity (Low): the attacker can modify displayed email content, inject phishing forms, redirect users to malicious sites, and potentially send emails on behalf of the victim. Availability is not directly impacted (A:N). Despite the Low impact ratings for individual CIA metrics, the EPSS score of 82.69% at the 99.2nd percentile indicates that this vulnerability is among the most exploited XSS flaws in any web application. In environments where Roundcube handles sensitive email communications, session hijacking through this XSS can lead to complete account takeover, data exfiltration, and lateral phishing attacks.
Exploit Maturity
CVE-2020-13965 has an exceptionally mature exploit landscape. A public proof-of-concept exploit is available on GitHub, demonstrating how to craft a malicious XML attachment that triggers JavaScript execution when previewed. CISA added this vulnerability to the KEV catalog in 2024, four years after its initial disclosure, indicating continued exploitation against unpatched Roundcube installations. The EPSS score of 82.69% at the 99.2nd percentile places it among the top 1% of all vulnerabilities by exploitation probability. Roundcube released fixed versions 1.3.12 and 1.4.5 in June 2020, and the specific commit fixing the vulnerability is publicly available. The ransomware association is listed as unknown.
Remediation
-
Upgrade Roundcube Webmail to version 1.3.12 or later (for the 1.3.x branch) or version 1.4.5 or later (for the 1.4.x branch). Ideally, upgrade to the latest stable release to benefit from all subsequent security fixes. Release notes are available at the Roundcube security advisory.
-
Review attachment handling configuration to restrict MIME types permitted for inline preview. Remove text/xml and application/xml from the allowed preview types if your organization does not require inline XML rendering.
-
Implement Content Security Policy (CSP) headers on your Roundcube installation to mitigate the impact of any remaining or future XSS vulnerabilities. A strict CSP that blocks inline script execution and restricts script sources significantly reduces the effectiveness of XSS attacks.
-
Audit Roundcube access logs for suspicious activity including unusual attachment previews, unexpected session reuse from different IP addresses, and mass email sending that may indicate compromised accounts through XSS-based session hijacking.
-
Consider deploying a web application firewall (WAF) in front of your Roundcube instance to detect and block common XSS payloads in attachments and request parameters as an additional defense layer.
Technical Details
CVE-2020-13965 is a cross-site scripting vulnerability in Roundcube Webmail with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, yielding a score of 6.1 (Medium). The Attack Vector is Network (AV:N), as the attacker delivers the malicious XML file as an email attachment. Attack Complexity is Low (AC:L), requiring only that the victim preview the attachment. No privileges are required (PR:N) because the attacker simply sends an email containing the malicious attachment. User Interaction is Required (UI:R) since the victim must click to preview the XML attachment. The Scope is Changed (S:C), indicating the XSS can affect resources beyond Roundcube's own security boundary, including browser sessions and cookies. The technical root cause is Roundcube's allowance of text/xml as a previewable MIME type. When a user previews an XML attachment, the browser renders the XML content, including any embedded JavaScript through mechanisms such as XML processing instructions, XSLT transformations, or SVG elements with script handlers. The fix in commit 884eb61 modifies the attachment handling to prevent direct rendering of XML content. Affected versions include all Roundcube releases before 1.3.12 and 1.4.0 through 1.4.4.
Frequently Asked Questions
Is CVE-2020-13965 being actively exploited?
Yes. Despite being disclosed in 2020, CISA added CVE-2020-13965 to the Known Exploited Vulnerabilities catalog in 2024, confirming continued active exploitation. Its EPSS score of 82.69% at the 99.2nd percentile places it among the most exploited web application vulnerabilities.
What versions of Roundcube are affected?
All Roundcube Webmail versions before 1.3.12 and versions 1.4.0 through 1.4.4 are affected. Debian Linux 9.0 and 10.0, and Fedora 31 and 32 distributions that shipped vulnerable Roundcube versions are also impacted.
How does the CVE-2020-13965 attack work?
An attacker sends an email with a malicious XML attachment to a Roundcube user. When the victim previews the attachment, the browser renders the XML content including embedded JavaScript, which executes in the context of the Roundcube session. This can lead to session hijacking, email theft, and phishing.
How do I fix CVE-2020-13965?
Upgrade Roundcube to version 1.3.12 or later, or 1.4.5 or later. The security updates are available from the official Roundcube website. Additionally, consider restricting XML MIME types from inline preview and implementing Content Security Policy headers.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.