CVE-2020-18671
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer...
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
- Record
CVE-2020-18671- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
- Record
CVE-2020-18671- Updated
- 2026-11-02
EUVDEUVD-2020-10595 No score
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
- Record
EUVD-2020-10595- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rxrc-3842-v7v6
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer...
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
- Record
GHSA-rxrc-3842-v7v6- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
- Record
CVE-2020-18671- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-18671
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
- Record
DEBIAN-CVE-2020-18671- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVUBUNTU-CVE-2020-18671
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
- Record
UBUNTU-CVE-2020-18671- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVBIT-roundcube-2020-18671 No score
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
- Record
BIT-roundcube-2020-18671- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0931-1 No score
Security update for roundcubemail
This update for roundcubemail fixes the following issues:
Upgrade to version 1.3.16
This is a security update to the LTS version 1.3.
It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content.
References:
- CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707)
- CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706)
- CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399)
- Record
openSUSE-SU-2021:0931-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0942-1 No score
Security update for roundcubemail
This update for roundcubemail fixes the following issues:
Upgrade to version 1.3.16
This is a security update to the LTS version 1.3.
It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content.
References:
- CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707)
- CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706)
- CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399)
- Record
openSUSE-SU-2021:0942-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0943-1 No score
Security update for roundcubemail
This update for roundcubemail fixes the following issues:
Upgrade to version 1.3.16
This is a security update to the LTS version 1.3.
It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content.
References:
- CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707)
- CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706)
- CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399)
- Record
openSUSE-SU-2021:0943-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0959-1 No score
Security update for roundcubemail
This update for roundcubemail fixes the following issues:
Upgrade to version 1.3.16
This is a security update to the LTS version 1.3.
It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content.
References:
- CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707)
- CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706)
- CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399)
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2021:0959-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0974-1 No score
Security update for roundcubemail
This update for roundcubemail fixes the following issues:
Upgrade to version 1.3.16
This is a security update to the LTS version 1.3.
It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content.
References:
- CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707)
- CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706)
- CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399)
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2021:0974-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1014-1 No score
Security update for roundcubemail
This update for roundcubemail fixes the following issues:
Upgrade to version 1.3.16
This is a security update to the LTS version 1.3.
It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content.
References:
- CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707)
- CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706)
- CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399)
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2021:1014-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
roundcubeBitnami |
before 1.4.4 | 1.4.4 |
roundcubeDebian:12 |
before 1.4.5+dfsg.1-1 | 1.4.5+dfsg.1-1 |
roundcubeDebian:13 |
before 1.4.5+dfsg.1-1 | 1.4.5+dfsg.1-1 |
roundcubeDebian:14 |
before 1.4.5+dfsg.1-1 | 1.4.5+dfsg.1-1 |
roundcubemailopenSUSE:Leap 15.2 |
before 1.3.16-lp152.4.6.1 | 1.3.16-lp152.4.6.1 |
roundcubemailSUSE:Package Hub 15 SP2 |
before 1.3.16-bp152.4.6.1 | 1.3.16-bp152.4.6.1 |
roundcubemailSUSE:Package Hub 15 SP1 |
before 1.3.16-bp151.4.6.1 | 1.3.16-bp151.4.6.1 |
roundcubemailSUSE:Package Hub 15 SP2 |
before 1.3.16-bp152.4.10.1 | 1.3.16-bp152.4.10.1 |
roundcubemailSUSE:Package Hub 15 SP2 |
before 1.3.16-bp152.4.14.1 | 1.3.16-bp152.4.14.1 |
roundcubemailSUSE:Package Hub 15 SP2 |
before 1.3.16-bp152.4.18.1 | 1.3.16-bp152.4.18.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-18671 is a medium vulnerability (CVSS 5.4) in Roundcube Webmail, published June 24, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.81%, the 57th percentile. Fixed in roundcube 1.4.4.
References
github.com/roundcube/roundcubemail/issues/7406
roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12
lorexxar.cn/2020/06/10/roundcube-mail-xss
nvd.nist.gov/vuln/detail/CVE-2020-18671
security-tracker.debian.org/tracker/CVE-2020-18671
Show 14 moreShow less
ubuntu.com/security/CVE-2020-18671
cve.org/CVERecord?id=CVE-2020-18671
lists.opensuse.org/archives/list/[email protected]/thread/BPPHYZD6Y3QJBTGPLX66Y3DJ3KCNEUJQ
bugzilla.suse.com/1180399
suse.com/security/cve/CVE-2020-18670