CVE-2023-5631

Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

Webmail

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.

18. Okt 2023

Ausgewertete Quellen

• Debian
  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079
• Debian
  https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html
• Debian
  https://www.debian.org/security/2023/dsa-5531
• Hinweis
  http://www.openwall.com/lists/oss-security/2023/11/01/1
• Hinweis
  http://www.openwall.com/lists/oss-security/2023/11/01/3
• Hinweis
  http://www.openwall.com/lists/oss-security/2023/11/17/2
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5631
• CISA
  Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
• NVD
  CVE-2023-5631