CVE-2020-18670

Upstream information

CVE-2020-18670 at MITRE

Description

Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.

---

SUSE information

Overall state of this security issue: Resolved

This issue is currently not rated by SUSE as it is not affecting the SUSE Enterprise products.

CVSS v2 Scores

	National Vulnerability Database
Base Score	3.5
Vector	AV:N/AC:M/Au:S/C:N/I:P/A:N
Access Vector	Network
Access Complexity	Medium
Authentication	Single
Confidentiality Impact	None
Integrity Impact	Partial
Availability Impact	None

CVSS v3 Scores

	National Vulnerability Database
Base Score	5.4
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector	Network
Attack Complexity	Low
Privileges Required	Low
User Interaction	Required
Scope	Changed
Confidentiality Impact	Low
Integrity Impact	Low
Availability Impact	None
CVSSv3 Version	3.1

SUSE Bugzilla entry: 1187707 [NEW]

SUSE Security Advisories:

• openSUSE-SU-2021:0931-1, published Sun Jun 27 12:40:35 2021
• openSUSE-SU-2021:0942-1, published Wed Jun 30 18:39:45 2021
• openSUSE-SU-2021:0943-1, published Wed Jun 30 18:39:45 2021
• openSUSE-SU-2021:0959-1, published Sat Jul 3 00:39:29 2021
• openSUSE-SU-2021:0974-1, published Mon Jul 12 15:44:30 2021
• openSUSE-SU-2021:1014-1, published Mon Jul 12 15:44:30 2021

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Package Hub 15 SP1	roundcubemail >= 1.3.16-bp151.4.6.1	Patchnames: openSUSE-2021-943
SUSE Package Hub 15 SP2	roundcubemail >= 1.3.16-bp152.4.18.1	Patchnames: openSUSE-2021-1014 openSUSE-2021-942 openSUSE-2021-959 openSUSE-2021-974
openSUSE Leap 15.2	roundcubemail >= 1.3.16-lp152.4.6.1	Patchnames: openSUSE-2021-931

---

SUSE Timeline for this CVE

CVE page created: Fri Jun 25 09:49:39 2021
CVE page last modified: Wed Aug 23 11:51:20 2023