Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 26/10/2023. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| webmail | ≥ 1.5.0, < 1.5.5≥ 1.6.0, < 1.6.4< 1.4.15 | 1.5.51.6.41.4.15 |
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free