Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
Summary
| CVE | CVE-2023-43770 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-09-22 06:15:00 UTC |
| Updated | 2023-09-26 15:42:00 UTC |
| Description | Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior. |
Risk And Classification
EPSS: 0.803890000 probability, percentile 0.991300000 (date 2026-04-22)
CISA KEV: Listed on 2024-02-12; due 2024-03-04; ransomware use Unknown
Problem Types: CWE-79
CISA Known Exploited Vulnerability
| Vendor | Roundcube |
|---|---|
| Product | Webmail |
| Name | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability |
| Required Action | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
| Notes | https://roundcube.net/news/2023/09/15/security-update-1.6.3-released ; https://nvd.nist.gov/vuln/detail/CVE-2023-43770 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Application | Roundcube | Webmail | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Fix cross-site scripting (XSS) vulnerability in handling of linkrefs … · roundcube/roundcubemail@e92ec20 · GitHub | MISC | github.com | |
| [SECURITY] [DLA 3577-1] roundcube security update | MLIST | lists.debian.org | |
| Security update 1.6.3 released | MISC | roundcube.net | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 150810 Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability (CVE-2023-43770)
- 200136 Ubuntu Security Notification for Roundcube Webmail Vulnerability (USN-6654-1)
- 6000106 Debian Security Update for roundcube (DLA 3577-1)
- 731153 Roundcube Webmail rcube_string_replacer.php Persistent Cross-Site Scripting (XSS) Vulnerability