← All advisories

Medium severity5.4NVD Advisory· Published Jun 24, 2021· Updated Jun 17, 2026

CVE-2020-18670

CVE-2020-18670

Description

Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7

Roundcube/Webmail
cpe:2.3:a:roundcube:webmail:1.4.4:*:*:*:*:*:*:*
Roundcube mail/Roundcube maildescription
Roundcube/Roundcubemailllm-fuzzy
Range: <=4.4
osv-coords4 versions
pkg:bitnami/roundcube pkg:rpm/opensuse/roundcubemail&distro=openSUSE%20Leap%2015.2 pkg:rpm/suse/roundcubemail&distro=SUSE%20Package%20Hub%2015%20SP1 pkg:rpm/suse/roundcubemail&distro=SUSE%20Package%20Hub%2015%20SP2
>= 1.4.4, <= 1.4.4+ 3 more
- (no CPE)range: >= 1.4.4, <= 1.4.4
- (no CPE)range: < 1.3.16-lp152.4.6.1
- (no CPE)range: < 1.3.16-bp151.4.6.1
- (no CPE)range: < 1.3.16-bp152.4.6.1

Patches

Vulnerability mechanics

References

3

github.com/roundcube/roundcubemail/issues/7406nvdPatchThird Party Advisory
roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12nvdPatchVendor Advisory
lorexxar.cn/2020/06/10/roundcube-mail-xss/nvdExploitThird Party Advisory

News mentions

0

No linked articles in our index yet.