What’s Vulnerable › Vulnerabilities

CVE-2017-6820

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-03-12 · updated 2026-06-17
• Weakness: CWE-79

Description

rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element.

Affected products

• Roundcube Webmail: through 1.1.7; 1.2.0, 1.2.1, 1.2.2, 1.2.3

References

• http://www.securityfocus.com/bid/96817
• https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db00d28ecc1554e9f4
• https://github.com/roundcube/roundcubemail/commit/fa2824fdcd44af3f970b2797feb47652482c8305
• https://github.com/roundcube/roundcubemail/releases/tag/1.1.8
• https://github.com/roundcube/roundcubemail/releases/tag/1.2.4
• https://github.com/roundcube/roundcubemail/wiki/Changelog#release-124
• https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released
• http://www.securityfocus.com/bid/96817
• https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db00d28ecc1554e9f4
• https://github.com/roundcube/roundcubemail/commit/fa2824fdcd44af3f970b2797feb47652482c8305
• https://github.com/roundcube/roundcubemail/releases/tag/1.1.8
• https://github.com/roundcube/roundcubemail/releases/tag/1.2.4

Get alerted when CVE-2017-6820 or the next vulnerability affects your stack