Vulnerability · Published Nov 5, 2023 · Assigned by mitre
CVE-2023-47272
Medium 6.1
In plain English
A medium-severity security flaw in the roundcube package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.6%top 49.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | roundcube | 1.6.5+dfsg-1~deb12u1 | DEBIAN-CVE-2023-47272 |
| Debian:12 | roundcube | 1.6.5+dfsg-1~deb12u1 | DSA-5572-1 |
| Debian:13 | roundcube | 1.6.5+dfsg-1 | DEBIAN-CVE-2023-47272 |
| Debian:14 | roundcube | 1.6.5+dfsg-1 | DEBIAN-CVE-2023-47272 |
Affected products (as reported)
References
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.6
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.5
- https://github.com/roundcube/roundcubemail/commit/5ec496885e18ec6af956e8c0d627856c2257ba2d
- FEDORA-2023-70578c5599 vendor-advisory
- FEDORA-2023-0fd9865145 vendor-advisory
- FEDORA-2023-cf584ed77a vendor-advisory
- DSA-5572 vendor-advisory
- [debian-lts-announce] 20231204 [SECURITY] [DLA 3683-1] roundcube security update mailing-list