CVE-2020-35730

Vulnerability Profile Updated 3 months ago

Download STIX

Preview STIX

CVE-2020-35730 is a Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail, first discovered three years ago. The flaw has been actively exploited by threat actors in various campaigns. In the BlueDelta and APT28 campaigns, spear-phishing techniques were employed, with email attachments designed to exploit this vulnerability, along with CVE-2020-12641 and CVE-2021-44026, in the Roundcube email client. Upon opening these malicious emails, the vulnerabilities were triggered, enabling threat actors to run reconnaissance and exfiltration scripts, redirect incoming emails, and gather session cookies, user information, and address books. The threat actor Winter Vivern was observed exploiting this vulnerability, along with CVE-2023-5631, since October 11, 2023. The group manipulated news about the Russo-Ukrainian conflict to trick targets into opening harmful emails that leveraged these vulnerabilities. ESET researchers noted that besides known vulnerabilities in Roundcube [CVE-2020-35730], the group also took advantage of another XSS vulnerability in Zimbra [CVE-2022-27926]. Protection against these threats is provided by Check Point IPS blade and Threat Emulation, specifically for Roundcube Webmail Command Injection (CVE-2020-12641), Roundcube Webmail Cross-Site Scripting (CVE-2020-35730), and APT.Wins.Nobelium. As these vulnerabilities have been widely exploited, it's crucial for organizations using affected software to apply necessary patches and employ defensive measures to mitigate potential risks.

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.

ID	Votes	Profile Description

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

roundcube

Exploit

Reconnaissance

Spearphishing

Ukraine

Eset

Vulnerability

Microsoft

Zimbra

exploited

Phishing

Associated Malware

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
No associations to display

Associated Threat Actors

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
APT28	Targets	3	APT28, also known as Fancy Bear, is a threat actor linked to Russia and has been involved in numerous cyber espionage campaigns. The group is notorious for its sophisticated tactics, techniques, and procedures (TTPs). Recently, NATO and the EU formally condemned APT28's activities, acknowledging the
Bluedelta	Unspecified	1	Bluedelta is a threat actor associated with the Russian state-sponsored hacking operation APT28 or Fancy Bear. In a recent spear-phishing campaign that began in November 2021, several government entities and a military aviation organization in Ukraine had their email servers targeted by Bluedelta. T

Associated Vulnerabilities

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
CVE-2020-12641	Unspecified	5	CVE-2020-12641 is a significant vulnerability discovered in the Roundcube Webmail application. It is an issue that arises from a flaw in the software's design or implementation, which allows for Command Injection and Cross-Site Scripting (XSS) attacks (CVE-2020-35730). The exploitation of this vulne
CVE-2021-44026	Unspecified	4	None
CVE-2023-5631	is related to	2	CVE-2023-5631 is a software vulnerability that was identified and reported by ESET CNA on October 18, 2023. This flaw exists in the design or implementation of Roundcube webmail servers. The vulnerability can be exploited through specially crafted email messages, posing significant security risks.
CVE-2022-27926	Unspecified	1	CVE-2022-27926 is a software vulnerability identified in Zimbra instances. This flaw in software design or implementation has been exploited by Winter Vivern (also known as TA473), a Russian hacking group, to gain unauthorized access to sensitive email communications. The targets of this cyber espio
Follina	Unspecified	1	Follina, also known as CVE-2022-30190, is a notable software vulnerability that was discovered and exploited in the first half of 2022. This flaw, found in the Microsoft Windows Support Diagnostic Tool (MSDT), was weaponized by TA413, a cyber threat actor group with suspected ties to China. The grou

Source Document References

Information about the CVE-2020-35730 Vulnerability was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source	CreatedAt	Title
Securityaffairs	3 months ago	NATO and the EU formally condemned APT28 cyber espionage
Securityaffairs	8 months ago	Russia's APT8 exploited Outlook 0day to target EU NATO members
Securityaffairs	8 months ago	Russia-linked APT28 group spotted exploiting Outlook flaw to hijack MS Exchange accounts
CERT-EU	8 months ago	Advanced threat predictions for 2024 – GIXtools
Securelist	8 months ago	Kaspersky Security Bulletin: APT predictions 2024
CERT-EU	9 months ago	Winter Vivern’s Roundcube Zero-Day Exploits
CERT-EU	9 months ago	Several French critical networks subjected to Russian APT attacks
Securityaffairs	9 months ago	ANSSI warns of Russia-linked APT28 attacks on French entities
CERT-EU	9 months ago	Roundcube 0-day used to steal European government emails
CERT-EU	9 months ago	Russian hacking group seen exploiting Roundcube webmail zero-day
Securityaffairs	9 months ago	Winter Vivern APT exploited zero-day in Roundcube webmail software in recent attacks
CERT-EU	9 months ago	Pro-Russia group exploits zero-day in attacks on gov emails
CERT-EU	9 months ago	Winter Vivern APT exploits Rouncube zero-day in attacks on European entities
InfoSecurity-magazine	9 months ago	Winter Vivern: Zero-Day XSS Exploit Targets Roundcube Servers
CERT-EU	9 months ago	Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers
CERT-EU	9 months ago	Roundcube webmail zero-day exploited to spy on government entities (CVE-2023-5631) - Help Net Security
Checkpoint	a year ago	3rd July – Threat Intelligence Report - Check Point Research
CERT-EU	a year ago	Microsoft warns of rise in credential stealing attacks by Russia-linked group
CERT-EU	a year ago	Several bugs added to CISA vulnerability catalog
Securityaffairs	a year ago	CISA adds recently disclosed Apple flaws to its Known Exploited Vulnerabilities catalog