CVE-2023-5631
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Oct 26, 2023
- US federal agencies must remediate it by Nov 16, 2023 (BOD 22-01)
- First attack observed 6 days after disclosure
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Source: CISA KEV · Jun 12, 2024 May 14, 2024 Mar 13, 2024 Mar 7, 2024 Feb 20, 2024 Feb 17, 2024
CVSS score6.1 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NWeakness type (CWE)CWE-79, CWE-79
Vendorsdebian, fedoraproject, roundcube
Affected products
| Vendors | Product | Versions |
|---|---|---|
| roundcube | webmail | < 1.4.15 |
| debian | debian linux | 10.0 |
| fedoraproject | fedora | 39 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.