CVEs / CVE-2023-5631
CVE-2023-5631: Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
- Known exploited in the CISA KEV catalog since 26 Oct 2023
- medium 5.4 CVSS 3.1 (NVD)
- EPSS 76.3% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2023-5631
Summary
Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.
Description
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Roundcube Roundcubemail | from 1.6.0, before 1.6.3 | 1.6.3 |
| Roundcube Roundcubemail | from 1.5.0, before 1.5.4 | 1.5.4 |
| Roundcube Roundcubemail | from 1.4.0, before 1.5.14 | 1.5.14 |
Exploitation
| In CISA KEV since | 26 Oct 2023 |
|---|---|
| Due date for US federal agencies | 16 Nov 2023 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 5.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NScored by NVD |
|---|---|
| Weakness | CWE-79 |
References
- CVE-2023-5631 on NVD
- CVE-2023-5631 in the CISA KEV catalog
- https://roundcube.net/news/2023/10/16/security-update-1.6.4-released (cited by CISA)
- https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15 (cited by CISA)
- CVE-2023-5631 on OSV
- http://www.openwall.com/lists/oss-security/2023/11/01/1 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/11/01/3 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/11/17/2 Mailing List, Third Party Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079 Mailing List, Patch
- https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d Patch
- https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613 Patch
- https://github.com/roundcube/roundcubemail/issues/9168 Exploit, Issue Tracking
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.15 Release Notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.5 Release Notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.4 Release Notes
- https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LK67Q46OIEGJCRQUBHKLH3IIJTBNGGX4/ Mailing List
- https://roundcube.net/news/2023/10/16/security-update-1.6.4-released Release Notes
- https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15 Release Notes
- https://www.debian.org/security/2023/dsa-5531 Mailing List
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5631 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.