Cross-Site Scripting Vulnerability in Roundcube Webmail by Roundcube
CVE-2020-15562
6.1MEDIUM
What is CVE-2020-15562?
An issue in Roundcube Webmail allows attackers to execute JavaScript payloads via specially crafted HTML email messages. The vulnerability arises when SVG elements exist within the email, which can lead to arbitrary script execution if an attacker manipulates the xmlns (XML namespace) attribute of a HEAD element. This flaw affects multiple versions prior to the recent updates, emphasizing the importance of regular software maintenance and updates to mitigate such risks.
References
CVSS V3.1
Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved