CVE:CVE-2020-35730
CNNVD:CNNVD-202012-1636
Roundcube Webmail是一款基于浏览器的开源IMAP客户端，它支持地址薄管理、信息搜索、拼写检查等。
Roundcube Webmail 1.4.10之前版本存在跨站脚本漏洞，该漏洞源于rcube string replacer.php中的linkref addindex允许通过精心制作的电子邮件消息进行XSS。
solution:Upgrade roundcube webmail to a higher version than 1.2.13,1.3.16,1.4.10,and avoid the version (,1.2.13),[1.3.0,1.3.16),[1.4,1.4.10); Upgrade fedoraproject fedora to a higher version than 32,33,and avoid the version 32,33; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0