Actively exploited · Published Oct 18, 2023 · Assigned by ESET
CVE-2023-5631Stored XSS vulnerability in Roundcube
Medium 6.1 Exploited
In plain English
A medium-severity cross-site scripting in Roundcubemail from Roundcube. Attackers are actively exploiting it in the wild (listed by CISA on October 26, 2023). The chance it is exploited in the next 30 days is estimated at 76.3% (higher than 99.5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Nov 16, 2023.
Official description
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | roundcube | 1.6.4+dfsg-1~deb12u1 | DEBIAN-CVE-2023-5631 |
| Debian:12 | roundcube | 1.6.4+dfsg-1~deb12u1 | DSA-5531-1 |
| Debian:13 | roundcube | 1.6.4+dfsg-1 | DEBIAN-CVE-2023-5631 |
| Debian:14 | roundcube | 1.6.4+dfsg-1 | DEBIAN-CVE-2023-5631 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Roundcube | Roundcubemail | 1.6.0 – before 1.6.31.5.0 – before 1.5.41.4.0 – before 1.5.14 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.4
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.5
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.15
- https://github.com/roundcube/roundcubemail/issues/9168
- https://roundcube.net/news/2023/10/16/security-update-1.6.4-released
- https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d
- https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079
- https://www.debian.org/security/2023/dsa-5531
- https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html
- http://www.openwall.com/lists/oss-security/2023/11/01/1
- http://www.openwall.com/lists/oss-security/2023/11/01/3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LK67Q46OIEGJCRQUBHKLH3IIJTBNGGX4/
- http://www.openwall.com/lists/oss-security/2023/11/17/2
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5631 government-resource