PT-2023-6963 · Roundcube+3 · Roundcube+3

Rene Rehme · Publicado 2023-11-05 · Atualizado 2024-08-21 · CVE-2023-47272

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Roundcube versions 1.5.x through 1.5.5 Roundcube versions 1.6.x through 1.6.4

Description The issue is related to improper input neutralization during web page creation, which can lead to cross-site scripting (XSS) attacks via a Content-Type or Content-Disposition header, specifically when used for attachment preview or download. This can allow a remote attacker to conduct cross-site scripting attacks.

Recommendations For Roundcube versions 1.5.x through 1.5.5, update to version 1.5.6 or later. For Roundcube versions 1.6.x through 1.6.4, update to version 1.6.5 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2023-07982

BIT-ROUNDCUBE-2023-47272

CVE-2023-47272

DLA-3683-1

DSA-5572-1

MGASA-2023-0332

OPENSUSE-SU-2024:0257-1

OPENSUSE-SU-2024:13401-1

USN-6848-1

Produtos afetados

Linuxmint

Red Os

Roundcube

Ubuntu

Referências · 43

• 🔥 https://github.com/bartfroklage/CVE-2024-37383-POC · Exploit
• 🔥❌ https://github.com/greandfather/EXPLOIT-Roundcube-vulnerability-POC-CVE-2023-5631- · Exploit, Deleted
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.4 · Nota
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.6 · Nota
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.5 · Nota
• https://github.com/roundcube/roundcubemail/commit/5ec496885e18ec6af956e8c0d627856c2257ba2d · Correção
• https://github.com/roundcube/roundcubemail/commit/81ac3c342a4f288deb275590895b52ec3785cf8a · Nota
• https://ubuntu.com/security/CVE-2023-47272 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GILSR762MJB3BNJOVOCMW2JXEPV46IIQ · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-47272 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-47272 · Aviso do Fabricante
• https://t.me/cvenotify/65484 · Publicação no Telegram
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFRGBPET73URF6364CI547ZVWQESJLGK · Aviso do Fabricante
• https://t.me/latest_high_impact_cve/71 · Publicação no Telegram
• https://advisories.mageia.org/MGASA-2023-0332.html · Nota de Segurança