CVE-2023-5631

Katalog CVE

CVSS 5.4 · Medium KEV · sudah dieksploitasi EPSS 75,9%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada roundcube webmail, debian linux +1 lainnya. Skor CVSS 3.1 5.4 (Medium) menurut NVD. Masuk katalog KEV CISA pada 26 Oktober 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.

Rincian

Terbit di NVD

18 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

75,9% peluang dieksploitasi; lebih tinggi dari 99,5% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

Masuk KEV

26 Oktober 2023

Tenggat CISA

16 November 2023 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079 mailing list · patch
• https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d patch
• https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613 patch
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5631 pemerintah AS
• http://www.openwall.com/lists/oss-security/2023/11/01/1 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2023/11/01/3 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2023/11/17/2 mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html mailing list · advisory pihak ketiga
• https://github.com/roundcube/roundcubemail/issues/9168 exploit · issue tracking
• https://github.com/roundcube/roundcubemail/releases/tag/1.4.15 release notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.5 release notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.4 release notes
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LK67Q46OIEGJCRQ... mailing list
• https://roundcube.net/news/2023/10/16/security-update-1.6.4-released release notes
• https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15 release notes
• https://www.debian.org/security/2023/dsa-5531 mailing list