Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2023-5631
HistoryOct 18, 2023 - 3:15 p.m.

CVE-2023-5631

2023-10-1815:15:08
CWE-79
[email protected]
web.nvd.nist.gov
1
roundcube
xss
html
svg
remote attacker

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.9 Medium

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

80.1%

JSON

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker

to load arbitrary JavaScript code.

Affected configurations

NVD
Node
roundcubewebmailRange<1.4.15
OR
roundcubewebmailRange1.5.0–1.5.5
OR
roundcubewebmailRange1.6.0–1.6.4
Node
debiandebian_linuxMatch10.0
OR
debiandebian_linuxMatch11.0
OR
debiandebian_linuxMatch12.0
OR
fedoraprojectfedoraMatch39

References

Related

veracode 1
osv 7
cisa_kev 1
hivepro 2
nessus 7
redos 1
openvas 7
ubuntucve 1
attackerkb 1
cvelist 1
fedora 1
debian 2
prion 1
debiancve 1
cve 2
thn 1
mageia 1
nvd 1
ubuntu 1
avleonov 1
veracode
veracode
Cross-site Scripting (XSS)
2023-10-19 04:33:25
osv
osv
BIT-2023-5631
2023-10-25 06:26:46
CVE-2023-5631
2023-10-18 15:15:08
roundcube - security update
2023-10-23 00:00:00
cisa_kev
cisa_kev
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
2023-10-26 00:00:00
hivepro
hivepro
Attacks, Vulnerabilities and Actors 23 October to 29 October 2023
2023-10-31 05:56:21
Winter Vivern Capitalizes on Zero-Day Flaw in Roundcube
2023-10-27 07:45:29
nessus
nessus
openSUSE 15 Security Update : roundcubemail (openSUSE-SU-2023:0345-1)
2023-11-03 00:00:00
Fedora 39 : roundcubemail (2023-735ee6d4e1)
2023-11-07 00:00:00
Fedora 37 : roundcubemail (2023-562e77957f)
2023-10-25 00:00:00
redos
redos
ROS-20231025-01
2023-10-25 00:00:00
openvas
openvas
Roundcube Webmail < 1.4.15, 1.5.x < 1.5.5, 1.6.x < 1.6.4 XSS Vulnerability
2023-10-19 00:00:00
openSUSE: Security Advisory for roundcubemail (openSUSE-SU-2023:0345-1)
2024-03-04 00:00:00
Fedora: Security Advisory for roundcubemail (FEDORA-2023-735ee6d4e1)
2023-11-05 00:00:00
ubuntucve
ubuntucve
CVE-2023-5631
2023-10-18 00:00:00
attackerkb
attackerkb
CVE-2023-5631
2023-10-18 00:00:00
cvelist
cvelist
CVE-2023-5631 Stored XSS vulnerability in Roundcube
2023-10-18 14:51:18
fedora
fedora
[SECURITY] Fedora 39 Update: roundcubemail-1.6.4-1.fc39
2023-11-03 18:58:35
debian
debian
[SECURITY] [DLA 3630-1] roundcube security update
2023-10-24 21:50:43
[SECURITY] [DSA 5531-1] roundcube security update
2023-10-23 06:47:23
prion
prion
Cross site scripting
2023-10-18 15:15:00
debiancve
debiancve
CVE-2023-5631
2023-10-18 15:15:08
cve
cve
CVE-2023-5631
2023-10-18 15:15:08
CVE-2023-46267
2023-10-20 04:15:10
thn
thn
Nation State Hackers Exploiting Zero-Day in Roundcube Webmail Software
2023-10-25 13:20:00
mageia
mageia
Updated roundcubemail packages fix XSS security vulnerabilities
2023-12-01 14:54:47
nvd
nvd
CVE-2023-46267
2023-10-20 04:15:10
ubuntu
ubuntu
Roundcube vulnerabilities
2024-06-25 00:00:00
avleonov
avleonov
November 2023 – January 2024: New Vulristics Features, 3 Months of Microsoft Patch Tuesdays and Linux Patch Wednesdays, Year 2023 in Review
2024-02-01 17:07:20

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.9 Medium

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

80.1%

JSON
Related for NVD:CVE-2023-5631
veracode1osv7cisa_kev1hivepro2nessus7redos1openvas7ubuntucve1attackerkb1cvelist1fedora1debian2prion1debiancve1cve2thn1mageia1nvd1ubuntu1avleonov1