Stored XSS vulnerability in Roundcube
Affects Roundcubemail 1.4.0 through 1.5.13, 1.5.0 through 1.5.3, and 1.6.0 through 1.6.2 when processing HTML messages with SVG content. CVSS rates it Medium at 6.1. Fixed in 1.6.4, 1.5.14, 1.5.4 and 1.6.3.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 1.6.3, 1.5.4, 1.5.14
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Roundcube, an open-source webmail client, is affected by this vulnerability. A remote attacker could send a crafted HTML email containing a malicious SVG document that, when viewed, runs arbitrary JavaScript in the user's browser.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Roundcube Roundcubemail
From 1.6.0 · fixed in 1.6.3; From 1.5.0 · fixed in 1.5.4; From 1.4.0 · fixed in 1.5.14
References 15
GitHub · roundcube/roundcubemail
roundcube.net
bugs.debian.org
debian.org
lists.debian.org
openwall.com
Questions about CVE-2023-5631
What does this mean?
Roundcube did not handle SVG content inside HTML email messages safely, which allowed cross-site scripting. Through this flaw, arbitrary JavaScript could be loaded when such a message was processed.Source: roundcube.net, roundcube.net
Am I affected, and how do I check?
Roundcubemail 1.4.0 to before 1.5.14, 1.5.0 to before 1.5.4, and 1.6.0 to before 1.6.3 are listed as affected, and the fix is in 1.6.4. To check, look at the installed Roundcube version and confirm whether it falls within one of these ranges; the risk depends on processing HTML messages containing SVG content.Source: roundcube.net, roundcube.net
What should I do about it?
Update all productive installations to the fixed releases: 1.6.4 for the 1.6.x line, and the fixed 1.5.x or 1.4.x releases (1.5.14 for 1.4.x, 1.5.4 or later for 1.5.x) for older branches. The advisory strongly recommends updating all productive installations.Source: roundcube.net, roundcube.net
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-10-26, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data