PT-2023-6963 · Roundcube+3 · Roundcube+3

Rene Rehme · Published 2023-11-05 · Updated 2024-08-21 · CVE-2023-47272

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Roundcube versions 1.5.x through 1.5.5 Roundcube versions 1.6.x through 1.6.4

Description The issue is related to improper input neutralization during web page creation, which can lead to cross-site scripting (XSS) attacks via a Content-Type or Content-Disposition header, specifically when used for attachment preview or download. This can allow a remote attacker to conduct cross-site scripting attacks.

Recommendations For Roundcube versions 1.5.x through 1.5.5, update to version 1.5.6 or later. For Roundcube versions 1.6.x through 1.6.4, update to version 1.6.5 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-07982

BIT-ROUNDCUBE-2023-47272

CVE-2023-47272

DLA-3683-1

DSA-5572-1

MGASA-2023-0332

OPENSUSE-SU-2024:0257-1

OPENSUSE-SU-2024:13401-1

USN-6848-1

Affected Products

Linuxmint

Red Os

Roundcube

Ubuntu

References · 43

• 🔥 https://github.com/bartfroklage/CVE-2024-37383-POC · Exploit
• 🔥❌ https://github.com/greandfather/EXPLOIT-Roundcube-vulnerability-POC-CVE-2023-5631- · Exploit, Deleted
• https://github.com/roundcube/roundcubemail/commit/5ec496885e18ec6af956e8c0d627856c2257ba2d · Patch
• https://ubuntu.com/security/CVE-2023-47272 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GILSR762MJB3BNJOVOCMW2JXEPV46IIQ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47272 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-47272 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFRGBPET73URF6364CI547ZVWQESJLGK · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0332.html · Security Note
• https://osv.dev/vulnerability/DSA-5572-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-roundcube-2023-47272 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0332 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3683-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-5631 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:0257-1 · Vendor Advisory