CVE-2017-6820 — Cross-site Scripting in Webmail

CWE-79 — Cross-site Scripting7 documents6 sources
Severity
6.1MEDIUMNVD
EPSS
0.6%
top 31.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Roundcube WebmailRoundcube Webmail
Timeline
PublishedMar 12
Latest updateMar 30

Description

rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶Ubunturoundcube/roundcube_webmail< 1.2~beta+dfsg.1-0ubuntu1+esm7+1
▶NVDroundcube/webmail1.1.7+4

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
roundcube vulnerabilities↗2026-03-30
▶
GHSA
GHSA-76mh-6w46-rwcg: rcube_utils↗2022-05-14
▶
OSV
CVE-2017-6820: rcube_utils↗2017-03-12
▶
CVEList
CVE-2017-6820: rcube_utils↗2017-03-12
▶

📋Vendor Advisories

2
Ubuntu
Roundcube Webmail vulnerabilities↗2026-03-30
▶
Debian
CVE-2017-6820: roundcube - rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible ...↗2017
▶
CVE-2017-6820 — Cross-site Scripting in Webmail | cvebase