Lucene search

[email protected]CVE-2023-5631

HistoryOct 18, 2023 - 3:15 p.m.

CVE-2023-5631

2023-10-1815:15:08

CWE-79

[email protected]

web.nvd.nist.gov

253

In Wild

roundcube

xss

html e-mail

svg

nvd

cve-2023-5631

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.3 Medium

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

80.1%

JSON

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker

to load arbitrary JavaScript code.

Affected configurations

NVD

Node

roundcubewebmailRange<1.4.15

roundcubewebmailRange1.5.0–1.5.5

roundcubewebmailRange1.6.0–1.6.4

Node

debiandebian_linuxMatch10.0

debiandebian_linuxMatch11.0

debiandebian_linuxMatch12.0

fedoraprojectfedoraMatch39

CPENameOperatorVersion
roundcube:webmailroundcube webmaillt1.4.15
roundcube:webmailroundcube webmaillt1.5.5
roundcube:webmailroundcube webmaillt1.6.4

CPE	Name	Operator	Version
roundcube:webmail	roundcube webmail	lt	1.4.15
roundcube:webmail	roundcube webmail	lt	1.5.5
roundcube:webmail	roundcube webmail	lt	1.6.4

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Roundcubemail",
    "repo": "https://github.com/roundcube/roundcubemail",
    "vendor": "Roundcube",
    "versions": [
      {
        "lessThan": "1.6.3",
        "status": "affected",
        "version": "1.6.0",
        "versionType": "semver"
      },
      {
        "lessThan": "1.5.4",
        "status": "affected",
        "version": "1.5.0",
        "versionType": "semver"
      },
      {
        "lessThan": "1.5.14",
        "status": "affected",
        "version": "1.4.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "1.6.4"
      },
      {
        "status": "unaffected",
        "version": "1.5.5"
      },
      {
        "status": "unaffected",
        "version": "1.5.15"
      }
    ]
  }
]