{"id":"CVE-2023-43770","aliases":["BIT-roundcube-2023-43770","DEBIAN-CVE-2023-43770","DLA-3577-1","EUVD-2023-48147","GHSA-g3fv-4f2h-xwv4","UBUNTU-CVE-2023-43770","USN-6654-1"],"status":"published","title":"Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e...","description":"Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.6366,"percentile":0.99229,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2023-09-22T00:00:00Z","modified":"2026-10-28T02:30:42Z","kev":{"date_added":"2024-02-12","due_date":"2024-03-04","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-02-12"},{"source":"kev","since":"2024-02-12"}],"exploits":[{"source":"pocgithub","id":"s3cb0y/CVE-2023-43770-POC","title":"s3cb0y/CVE-2023-43770-POC","date":"2023-09-27","url":"https://github.com/s3cb0y/CVE-2023-43770-POC"},{"source":"pocgithub","id":"knight0x07/CVE-2023-43770-PoC","title":"knight0x07/CVE-2023-43770-PoC","date":"2023-09-28","url":"https://github.com/knight0x07/CVE-2023-43770-PoC"},{"source":"pocgithub","id":"skyllpro/CVE-2021-44026-PoC","title":"skyllpro/CVE-2021-44026-PoC","date":"2025-04-20","url":"https://github.com/skyllpro/CVE-2021-44026-PoC"}],"fixes":[{"ecosystem":"Bitnami","package":"roundcube","fixed_in":["1.4.14","1.5.4","1.6.3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"roundcube","fixed_in":["1.6.3+dfsg-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"roundcube","fixed_in":["1.6.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"roundcube","fixed_in":["1.6.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"roundcube","fixed_in":["1.3.17+dfsg.1-1~deb10u3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"roundcube","fixed_in":["1.2~beta+dfsg.1-0ubuntu1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","fixed_in":["1.3.6+dfsg.1-1ubuntu0.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","fixed_in":["1.4.3+dfsg.1-1ubuntu0.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","fixed_in":["1.5.0+dfsg.1-2ubuntu0.1~esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"roundcube","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.14"},{"introduced":"1.5.0"},{"fixed":"1.5.4"},{"introduced":"1.6.0"},{"fixed":"1.6.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3+dfsg-1~deb12u1"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.17+dfsg.1-1~deb10u3"}]}],"versions":["1.3.10+dfsg.1-1","1.3.10+dfsg.1-1~deb10u1","1.3.11+dfsg.1-1~deb10u1","1.3.13+dfsg.1-1~deb10u1","1.3.14+dfsg.1-1~deb10u1","1.3.15+dfsg.1-1~deb10u1","1.3.16+dfsg.1-1~deb10u1","1.3.17+dfsg.1-1~deb10u1","1.3.17+dfsg.1-1~deb10u2","1.3.8+dfsg.1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2~beta+dfsg.1-0ubuntu1+esm3"}]}],"versions":["1.1.1+dfsg.1-2","1.1.2+dfsg.1-5","1.1.3+dfsg.1-1","1.1.4+dfsg.1-1","1.2~beta+dfsg.1-0ubuntu1","1.2~beta+dfsg.1-0ubuntu1+esm1","1.2~beta+dfsg.1-0ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6+dfsg.1-1ubuntu0.1~esm3"}]}],"versions":["1.3.0+dfsg.1-1","1.3.1+dfsg.1-1","1.3.3+dfsg.1-1","1.3.3+dfsg.1-2","1.3.6+dfsg.1-1","1.3.6+dfsg.1-1ubuntu0.1~esm1","1.3.6+dfsg.1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg.1-1ubuntu0.1~esm3"}]}],"versions":["1.3.8+dfsg.1-2","1.3.10+dfsg.1-1","1.4.1+dfsg.1-2","1.4.2+dfsg.1-1","1.4.2+dfsg.1-2","1.4.3+dfsg.1-1","1.4.3+dfsg.1-1ubuntu0.1~esm1","1.4.3+dfsg.1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0+dfsg.1-2ubuntu0.1~esm2"}]}],"versions":["1.4.11+dfsg.1-4","1.5.0+dfsg.1-2","1.5.0+dfsg.1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2~beta+dfsg.1-0ubuntu1+esm3"}]}],"versions":["1.1.1+dfsg.1-2","1.1.2+dfsg.1-5","1.1.3+dfsg.1-1","1.1.4+dfsg.1-1","1.2~beta+dfsg.1-0ubuntu1","1.2~beta+dfsg.1-0ubuntu1+esm1","1.2~beta+dfsg.1-0ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6+dfsg.1-1ubuntu0.1~esm3"}]}],"versions":["1.3.0+dfsg.1-1","1.3.1+dfsg.1-1","1.3.3+dfsg.1-1","1.3.3+dfsg.1-2","1.3.6+dfsg.1-1","1.3.6+dfsg.1-1ubuntu0.1~esm1","1.3.6+dfsg.1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg.1-1ubuntu0.1~esm3"}]}],"versions":["1.3.8+dfsg.1-2","1.3.10+dfsg.1-1","1.4.1+dfsg.1-2","1.4.2+dfsg.1-1","1.4.2+dfsg.1-2","1.4.3+dfsg.1-1","1.4.3+dfsg.1-1ubuntu0.1~esm1","1.4.3+dfsg.1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0+dfsg.1-2ubuntu0.1~esm2"}]}],"versions":["1.4.11+dfsg.1-4","1.5.0+dfsg.1-2","1.5.0+dfsg.1-2ubuntu0.1~esm1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"roundcube","product":"webmail"}],"references":[{"url":"https://github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49b","tags":["x_transferred","Patch","web","fix","report"]},{"url":"https://roundcube.net/news/2023/09/15/security-update-1.6.3-released","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00024.html","tags":["mailing-list","x_transferred","Mailing List","web","article","report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43770","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43770","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g3fv-4f2h-xwv4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43770.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-43770","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-43770","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6654-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-43770","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-43770","description":"Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.","status":"published","published":"2023-09-22T00:00:00Z","modified":"2025-10-21T23:05:36.969Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:14.633899Z"}],"euvd":[{"id":"EUVD-2023-48147","description":"Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.","status":"published","published":"2023-09-22T00:00:00Z","modified":"2025-10-21T23:05:36Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"exploited_since":"2024-02-12","updated_at":"2026-11-02T20:31:27.312976Z"}],"ghsa":[{"id":"GHSA-g3fv-4f2h-xwv4","title":"Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e...","description":"Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.","status":"published","published":"2023-09-22T06:30:19Z","modified":"2025-10-22T00:32:51Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:04:06.493434Z"}],"kev":[{"id":"CVE-2023-43770","title":"Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","description":"Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.","cwes":["CWE-79"],"kev":{"date_added":"2024-02-12","due_date":"2024-03-04","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-43770","description":"Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.","status":"published","published":"2023-09-22T06:15:10.09Z","modified":"2026-06-17T06:26:24.77Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:29.595868Z"}],"osv":[{"id":"CVE-2023-43770","description":"Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.","status":"published","published":"2023-09-22T00:00:00Z","modified":"2026-10-28T02:30:42.183426298Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"DEBIAN-CVE-2023-43770","description":"Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.","status":"published","published":"2023-09-22T06:15:10.09Z","modified":"2026-10-26T18:02:49.729439495Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"UBUNTU-CVE-2023-43770","description":"Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.","status":"published","published":"2023-09-22T06:15:00Z","modified":"2026-02-04T03:37:52.338576Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"BIT-roundcube-2023-43770","description":"Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.","status":"published","published":"2024-03-06T11:04:14.663Z","modified":"2024-03-06T11:25:28.861Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"DLA-3577-1","title":"roundcube - security update","status":"published","published":"2023-09-22T00:00:00Z","modified":"2026-03-09T01:21:32.856246Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"USN-6654-1","title":"roundcube vulnerability","description":"It was discovered that Roundcube Webmail incorrectly sanitized characters\nin the linkrefs text messages. An attacker could possibly use this issue to\nexecute a cross-site scripting (XSS) attack. (CVE-2023-43770)\n","status":"published","published":"2024-02-26T03:46:59Z","modified":"2026-06-25T13:32:28.622327328Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}