Actively exploited · Published Sep 22, 2023 · Assigned by mitre
CVE-2023-43770
Medium 6.1 Exploited
In plain English
A medium-severity cross-site scripting in Webmail from Roundcube. Attackers are actively exploiting it in the wild (listed by CISA on February 12, 2024). The chance it is exploited in the next 30 days is estimated at 63.7% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Mar 4, 2024.
Official description
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | roundcube | 1.6.3+dfsg-1~deb12u1 | DEBIAN-CVE-2023-43770 |
| Debian:13 | roundcube | 1.6.3+dfsg-1 | DEBIAN-CVE-2023-43770 |
| Debian:14 | roundcube | 1.6.3+dfsg-1 | DEBIAN-CVE-2023-43770 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49b
- https://roundcube.net/news/2023/09/15/security-update-1.6.3-released
- [debian-lts-announce] 20230922 [SECURITY] [DLA 3577-1] roundcube security update mailing-list
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43770 government-resource