H3XA — Operational Evidence

TypeVulnerability

External ID—

First seen2023-06-22

Last seen2023-06-22

Confidence

—

Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.

Labels

exploitedkev

CISA KEV context

Vendor / productRoundcube Roundcube Webmail

Added2023-06-22

Due date2023-07-13

7 recorded

Relationships

mitigates

from Remediate CVE-2020-35730

Mitigation

related-to

to AJAX Footprinting

Technique

related-to

to Cross-Site Scripting (XSS)

Technique

related-to

to DOM-Based XSS

Technique

related-to

to Reflected XSS

Technique

related-to

to Stored XSS

Technique

related-to

to XSS Using MIME Type Mismatch

Technique

2 external

References

nvd

CVE-2020-35730

open

cwe

CWE-79

open