PT-2023-5637 · Roundcube+4 · Roundcube+4

Niraj Shivtarkar · Published 2019-11-09 · Updated 2025-10-31 · CVE-2023-43770

Positive Technologies · (AI Summary)

CVSS v2.0

6.4

Medium

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Roundcube versions prior to 1.4.14, 1.5.x prior to 1.5.4, and 1.6.x prior to 1.6.3

Description Roundcube Webmail contains a cross-site scripting (XSS) issue due to insufficient sanitization of characters in link references within text messages. This allows a remote attacker to potentially execute malicious JavaScript code within the context of a user's browser. The vulnerability exists in the program/lib/Roundcube/rcube string replacer.php component. The vulnerability is actively exploited in the wild by threat actors, including the Winter Vivern (APT28/TA473/UAC-0114) group. Approximately 39,000 instances were reported as vulnerable as of February 20, 2024. The vulnerability allows attackers to gain access to restricted information. The API endpoints are not explicitly mentioned in the provided descriptions. The vulnerable parameter is not explicitly mentioned in the provided descriptions.

Recommendations Update Roundcube to a version prior to 1.4.14, 1.5.x prior to 1.5.4, and 1.6.x prior to 1.6.3.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2019-3109

ALT-PU-2020-1898

ALT-PU-2020-2367

ALT-PU-2021-3558

ALT-PU-2022-1073

ALT-PU-2023-6826

ALT-PU-2025-1825

ALT-PU-2025-8283

BDU:2023-06297

BIT-ROUNDCUBE-2023-43770

CVE-2023-43770

DLA-3577-1

USN-6654-1

Affected Products

Alt Linux

Linuxmint

Red Os

Roundcube

Ubuntu

References · 102

• 🔥 https://github.com/fearsoff-org/CVE-2025-49113 · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube · Exploit
• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube · Exploit
• 🔥 https://github.com/s3cb0y/CVE-2023-43770-POC · Exploit
• 🔥 https://github.com/pentesttoolscom/roundcube-cve-2021-44026 · Exploit
• 🔥 https://github.com/bartfroklage/CVE-2024-37383-POC · Exploit
• 🔥 https://github.com/knight0x07/CVE-2023-43770-PoC · Exploit
• 🔥❌ https://github.com/greandfather/EXPLOIT-Roundcube-vulnerability-POC-CVE-2023-5631- · Exploit, Deleted
• https://github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49b · Patch
• https://osv.dev/vulnerability/DLA-3577-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-43770 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-43770 · Security Note
• https://osv.dev/vulnerability/USN-6654-1 · Vendor Advisory