Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6848-1 advisory.

    Matthieu Faou and Denys Klymenko discovered that Roundcube incorrectly handled certain SVG images. A     remote attacker could possibly use this issue to load arbitrary JavaScript code. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-5631)

    Rene Rehme discovered that Roundcube incorrectly handled certain headers. A remote attacker could possibly     use this issue to load arbitrary JavaScript code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04     LTS and Ubuntu 23.10. (CVE-2023-47272)

    Valentin T. and Lutz Wolf discovered that Roundcube incorrectly handled certain SVG images. A remote     attacker could possibly use this issue to load arbitrary JavaScript code. This issue only affected Ubuntu     18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2024-37383)

    Huy Nguyn Phm Nht discovered that Roundcube incorrectly handled certain fields in user     preferences. A remote attacker could possibly use this issue to load arbitrary JavaScript code.
    (CVE-2024-37384)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-735ee6d4e1 advisory.

  - Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail     message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This     could allow a remote attacker to load arbitrary JavaScript code. (CVE-2023-5631)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0345-1 advisory.

  - Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail     message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This     could allow a remote attacker to load arbitrary JavaScript code. (CVE-2023-5631)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-955e390a13 advisory.

  - Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail     message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This     could allow a remote attacker to load arbitrary JavaScript code. (CVE-2023-5631)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-562e77957f advisory.

  - Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail     message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This     could allow a remote attacker to load arbitrary JavaScript code. (CVE-2023-5631)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3630 advisory.

  - Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a     crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15. (CVE-2020-16145)

  - Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail     message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This     could allow a remote attacker to load arbitrary JavaScript code. (CVE-2023-5631)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5531 advisory.

  - Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail     message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This     could allow a remote attacker to load arbitrary JavaScript code. (CVE-2023-5631)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
201016	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : Roundcube vulnerabilities (USN-6848-1)	Nessus	Ubuntu Local Security Checks	medium
185190	Fedora 39 : roundcubemail (2023-735ee6d4e1)	Nessus	Fedora Local Security Checks	medium
184347	openSUSE 15 Security Update : roundcubemail (openSUSE-SU-2023:0345-1)	Nessus	SuSE Local Security Checks	medium
183872	Fedora 38 : roundcubemail (2023-955e390a13)	Nessus	Fedora Local Security Checks	medium
183870	Fedora 37 : roundcubemail (2023-562e77957f)	Nessus	Fedora Local Security Checks	medium
183837	Debian DLA-3630-1 : roundcube - LTS security update	Nessus	Debian Local Security Checks	medium
183687	Debian DSA-5531-1 : roundcube - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2023-5631

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium