6.1
Medium
CVE-2023-5631 Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns
Not observed so far
Weakness
CWE-79
Description
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Roundcubemail 1.6 | 1.6.0 → < 1.6.3 | 1.6.3 |
| Roundcubemail 1.5 | 1.5.0 → < 1.5.4 | 1.5.4 |
| Roundcubemail 1.4 | 1.4.0 → < 1.5.14 | 1.5.14 |