← CVE Radar
CVE-2023-5631Stored XSS vulnerability in Roundcube
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.
6.1 MEDIUMEPSS 76.33%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 6.1 | MEDIUM | 3.1ESET (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| 5.4 | MEDIUM | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CISA required action
⚡ Known exploited · remediation due Nov 16, 2023
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2023-5631
- Status
- Analyzed
- Assigner (CNA)
- ESET
- Published
- Oct 18, 2023
- Last modified
- 2026-06-17 06:48 UTC
- Weaknesses
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
As published by the CNA in the CVE record.
RoundcubeRoundcubemail3 version ranges
- 1.6.0 before 1.6.3
- 1.5.0 before 1.5.4
- 1.4.0 before 1.5.14
References
- openwall.com http://www.openwall.com/lists/oss-security/2023/11/01/1
- openwall.com http://www.openwall.com/lists/oss-security/2023/11/01/3
- openwall.com http://www.openwall.com/lists/oss-security/2023/11/17/2
- bugs.debian.org https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079
- github.com https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d
- github.com https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613
- github.com https://github.com/roundcube/roundcubemail/issues/9168
- github.com https://github.com/roundcube/roundcubemail/releases/tag/1.4.15
- github.com https://github.com/roundcube/roundcubemail/releases/tag/1.5.5
- github.com https://github.com/roundcube/roundcubemail/releases/tag/1.6.4
- lists.debian.org https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/LK67Q46OIEGJCRQUBHKLH3IIJTBNGGX4/
- roundcube.net https://roundcube.net/news/2023/10/16/security-update-1.6.4-released
- roundcube.net https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15
- debian.org https://www.debian.org/security/2023/dsa-5531
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5631