PT-2023-29938 · Roundcube · Roundcube

Published 2023-10-19 · Updated 2023-10-21 · CVE-2023-46267

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Roundcube versions 1.4.x through 1.4.14 Roundcube versions 1.5.x through 1.5.4 Roundcube versions 1.6.x through 1.6.3

Description The issue allows for XSS via a text/html e-mail message containing an SVG image with a USE element. This is related to the wash uri function in rcube washtml.php. The exploitation occurs when a user receives a specially crafted email message.

Recommendations For Roundcube versions 1.4.x through 1.4.14, update to version 1.4.15 or later. For Roundcube versions 1.5.x through 1.5.4, update to version 1.5.5 or later. For Roundcube versions 1.6.x through 1.6.3, update to version 1.6.4 or later.

Related Identifiers

CVE-2023-46267

Affected Products

Roundcube

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2023-46267 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-46267 · Security Note
• https://ubuntu.com/security/CVE-2023-46267 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-46267 · Vendor Advisory
• https://github.com/roundcube/roundcubemail/issues/9168 · Note
• https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d · Note
• https://github.com/roundcube/roundcubemail/compare/1.4.14...1.4.15 · Note
• https://github.com/roundcube/roundcubemail/compare/1.5.4...1.5.5 · Note
• https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15 · Note
• https://roundcube.net/news/2023/10/16/security-update-1.6.4-released · Note
• https://t.me/cibsecurity/72636 · Telegram Post
• https://twitter.com/CVEnew/status/1715220962784756083 · Twitter Post