KNOWN EXPLOITED VULNERABILITY
CISA KEV 处置信息
已确认在野利用
- 加入 KEV
- 2023/06/22
- 整改期限
- 2023/07/13已逾期 1195 天
- CISA 厂商
- Roundcube
- CISA 产品
- Roundcube Webmail
要求采取的措施
Apply updates per vendor instructions.
CISA 说明
https://roundcube.net/news/2020/12/27/security-updates-1.4.10-1.3.16-and-1.2.13; https://nvd.nist.gov/vuln/detail/CVE-2020-35730
漏洞描述
Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.
影响产品
暂无结构化产品信息。
修复建议
Apply updates per vendor instructions.