CVE-2020-35730
Description
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
Summary dbcve.org
A stored XSS vulnerability in Roundcube Webmail allows attackers to inject malicious JavaScript via specially crafted plain text emails. The vulnerability exists in the linkref_addindex function within rcube_string_replacer.php, which improperly handles link reference elements in plain text email messages. When recipients view these emails, the injected script executes in their browser context.
Mitigation
Upgrade Roundcube Webmail to version 1.2.13, 1.3.16, or 1.4.10 or later to obtain the patched version of rcube_string_replacer.php that properly sanitizes link references in plain text emails.