An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12626
Reference (s):
- DEBIAN:DSA-4674
- URL: https://www.debian.org/security/2020/dsa-4674
- GENTOO:GLSA-202007-41
- URL: https://security.gentoo.org/glsa/202007-41
- https://github.com/roundcube/roundcubemail/commit/9bbda422ff0b782b81de59c86994f1a5fd93f8e6