PT-2023-5637 · Roundcube+4 · Roundcube+4

Niraj Shivtarkar · Publicado 2019-11-09 · Atualizado 2026-04-10 · CVE-2023-43770

Positive Technologies (AI Summary) · Pt

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Roundcube versões anteriores a 1.4.14, 1.5.x anteriores a 1.5.4 e 1.6.x anteriores a 1.6.3.

Description: Roundcube Webmail contém uma vulnerabilidade de scripting cross-site (XSS) no componente rcube string replacer.php devido à sanitização insuficiente de caracteres em mensagens de e-mail text/plain. Isso permite que um invasor remoto execute código JavaScript arbitrário no contexto do navegador da vítima. A vulnerabilidade está sendo ativamente explorada na natureza, com relatos de exploração pelo ator de ameaças Winter Vivern. A CISA adicionou esta vulnerabilidade (CVE-2023-43770) ao seu catálogo de Vulnerabilidades Conhecidas e Exploradas.

Recommendations: Atualize o Roundcube para a versão 1.4.14 ou posterior. Atualize o Roundcube para a versão 1.5.4 ou posterior. Atualize o Roundcube para a versão 1.6.3 ou posterior.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2019-3109

ALT-PU-2020-1898

ALT-PU-2020-2367

ALT-PU-2021-3558

ALT-PU-2022-1073

ALT-PU-2023-6826

ALT-PU-2025-1825

ALT-PU-2025-8283

BDU:2023-06297

BIT-ROUNDCUBE-2023-43770

CVE-2023-43770

DLA-3577-1

USN-6654-1

Produtos afetados

Alt Linux

Linuxmint

Red Os

Roundcube

Ubuntu

Referências · 103

• 🔥 https://github.com/fearsoff-org/CVE-2025-49113 · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube · Exploit
• 🔥 https://github.com/s3cb0y/CVE-2023-43770-POC · Exploit
• 🔥 https://github.com/pentesttoolscom/roundcube-cve-2021-44026 · Exploit
• 🔥 https://github.com/bartfroklage/CVE-2024-37383-POC · Exploit
• 🔥 https://github.com/knight0x07/CVE-2023-43770-PoC · Exploit
• 🔥❌ https://github.com/greandfather/EXPLOIT-Roundcube-vulnerability-POC-CVE-2023-5631- · Exploit, Deleted
• https://github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49b · Correção
• https://twitter.com/blackorbird/status/1923193264930197723 · Publicação no Twitter
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Nota
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Nota
• https://t.me/cvenotify/105171 · Publicação no Telegram