6.1
Moyenne
CVE-2023-5631 Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-79
Description
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Roundcubemail 1.6 | 1.6.0 → < 1.6.3 | 1.6.3 |
| Roundcubemail 1.5 | 1.5.0 → < 1.5.4 | 1.5.4 |
| Roundcubemail 1.4 | 1.4.0 → < 1.5.14 | 1.5.14 |