Every CVE Search/ Get API key

CVE-2023-43770

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e...

6.1 MediumIn KEVPublic exploitFix available

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

63.7%Up 63.6 points since Sep 22, 2023
90%50%10%1%

What each source reports

NVD Score used 6.1

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

Record
CVE-2023-43770
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List 6.1

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

Record
CVE-2023-43770
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2023-48147 6.1

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

Record
EUVD-2023-48147
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-g3fv-4f2h-xwv4 6.1

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e...

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

Record
GHSA-g3fv-4f2h-xwv4
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
CISA KEV No score

Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.

Record
CVE-2023-43770
Weakness
CWE-79
Updated
2026-11-02
OSV 6.1

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

Record
CVE-2023-43770
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2023-43770 6.1

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

Record
DEBIAN-CVE-2023-43770
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2023-43770 6.1

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

Record
UBUNTU-CVE-2023-43770
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVBIT-roundcube-2023-43770 No score

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

Record
BIT-roundcube-2023-43770
Updated
2026-11-02
OSVUSN-6654-1 No score

roundcube vulnerability

It was discovered that Roundcube Webmail incorrectly sanitized characters in the linkrefs text messages. An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. (CVE-2023-43770)

Record
USN-6654-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
roundcube
Bitnami
 before 1.4.14, 1.5.0 up to 1.5.4, 1.6.0 up to 1.6.3
1.4.141.5.41.6.3
roundcube
Debian:12
 before 1.6.3+dfsg-1~deb12u1, plus listed versions
1.6.1+dfsg-11.6.2+dfsg-1
1.6.3+dfsg-1~deb12u1
roundcube
Debian:13
 before 1.6.3+dfsg-1
1.6.3+dfsg-1
roundcube
Debian:14
 before 1.6.3+dfsg-1
1.6.3+dfsg-1
roundcube
Debian:10
 before 1.3.17+dfsg.1-1~deb10u3, plus listed versions
1.3.10+dfsg.1-11.3.10+dfsg.1-1~deb10u11.3.11+dfsg.1-1~deb10u11.3.13+dfsg.1-1~deb10u11.3.14+dfsg.1-1~deb10u1
Show 5 moreShow less
1.3.15+dfsg.1-1~deb10u11.3.16+dfsg.1-1~deb10u11.3.17+dfsg.1-1~deb10u11.3.17+dfsg.1-1~deb10u21.3.8+dfsg.1-2
1.3.17+dfsg.1-1~deb10u3
roundcube
Ubuntu:Pro:16.04:LTS
 before 1.2~beta+dfsg.1-0ubuntu1+esm3, plus listed versions
1.1.1+dfsg.1-21.1.2+dfsg.1-51.1.3+dfsg.1-11.1.4+dfsg.1-11.2~beta+dfsg.1-0ubuntu11.2~beta+dfsg.1-0ubuntu1+esm11.2~beta+dfsg.1-0ubuntu1+esm2
1.2~beta+dfsg.1-0ubuntu1+esm3
roundcube
Ubuntu:Pro:18.04:LTS
 before 1.3.6+dfsg.1-1ubuntu0.1~esm3, plus listed versions
1.3.0+dfsg.1-11.3.1+dfsg.1-11.3.3+dfsg.1-11.3.3+dfsg.1-21.3.6+dfsg.1-11.3.6+dfsg.1-1ubuntu0.1~esm11.3.6+dfsg.1-1ubuntu0.1~esm2
1.3.6+dfsg.1-1ubuntu0.1~esm3
roundcube
Ubuntu:Pro:20.04:LTS
 before 1.4.3+dfsg.1-1ubuntu0.1~esm3, plus listed versions
1.3.8+dfsg.1-21.3.10+dfsg.1-11.4.1+dfsg.1-21.4.2+dfsg.1-11.4.2+dfsg.1-21.4.3+dfsg.1-11.4.3+dfsg.1-1ubuntu0.1~esm11.4.3+dfsg.1-1ubuntu0.1~esm2
1.4.3+dfsg.1-1ubuntu0.1~esm3
roundcube
Ubuntu:Pro:22.04:LTS
 before 1.5.0+dfsg.1-2ubuntu0.1~esm2, plus listed versions
1.4.11+dfsg.1-41.5.0+dfsg.1-21.5.0+dfsg.1-2ubuntu0.1~esm1
1.5.0+dfsg.1-2ubuntu0.1~esm2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubs3cb0y/CVE-2023-43770-POC2023-09-27
PoC in GitHubknight0x07/CVE-2023-43770-PoC2023-09-28
PoC in GitHubskyllpro/CVE-2021-44026-PoC2025-04-20

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-43770 is a medium vulnerability (CVSS 6.1) in Debian Linux, published September 22, 2023. CISA lists it as known to be exploited, since February 12, 2024. EUVD reports exploitation since February 12, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 63.7%, the 99th percentile. Fixed in roundcube 1.4.14.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open