CVE-2023-43770: Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

CVE ID

CVE-2023-43770

Vulnerability Name

Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

• Project: Roundcube
• Product: Webmail

Date

• Date Added: 2024-02-12
• Due Date: 2024-03-04

Description

Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://roundcube.net/news/2023/09/15/security-update-1.6.3-released ; https://nvd.nist.gov/vuln/detail/CVE-2023-43770

Related Security News

• From Phishing to Malware: AI Becomes Russia's New Cyber Weapon in War on Ukraine
• Government webmail hacked via XSS bugs in global spy campaign
• Russia-Linked APT28 Exploited MDaemon Zero-Day to Hack Government Webmail Servers
• Hackers exploit Roundcube webmail flaw to steal email, credentials
• Roundcube flaws allow easy email account compromise (CVE-2024-42009, CVE-2024-42008)

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List