According to its self-reported version number, Roundcube Webmail is prior to 1.4.15 or 1.5.x prior to 1.5.5 or 1.6.x prior to 1.6.4. Therefore, it may be affected by a Cross-Site Scripting (XSS) vulnerability via an HTML e-mail message with a crafted SVG document.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5531 advisory.

    It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not     properly sanitize HTML messages. This would allow an attacker to load arbitrary JavaScript code. For the     oldstable distribution (bullseye), this problem has been fixed in version 1.4.15+dfsg.1-1~deb11u1. For the     stable distribution (bookworm), this problem has been fixed in version 1.6.4+dfsg-1~deb12u1. We recommend     that you upgrade your roundcube packages. For the detailed security status of roundcube please refer to     its security tracker page at: https://security-tracker.debian.org/tracker/roundcube

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3630 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3630-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     October 24, 2023                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : roundcube     Version        : 1.3.17+dfsg.1-1~deb10u4     CVE ID         : CVE-2023-5631     Debian Bug     : 1054079

    Denys Klymenko discovered a cross-site scripting (XSS) vulnerability in     Roundcube, a skinnable AJAX based webmail solution for IMAP servers,     which could allow a remote attacker to load arbitrary JavaScript code     via a malicious text/html e-mail message with a crafted SVG document.

    For Debian 10 buster, this problem has been fixed in version     1.3.17+dfsg.1-1~deb10u4.

    We recommend that you upgrade your roundcube packages.

    For the detailed security status of roundcube please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/roundcube

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-955e390a13 advisory.

    **Version 1.6.4**

    - Fix PHP8 warnings (#9142, #9160)
    - Fix default 'mime.types' path on Windows (#9113)
    - Managesieve: Fix javascript error when relational or spamtest extension is not enabled (#9139)
    - Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-735ee6d4e1 advisory.

    **Version 1.6.4**

    - Fix PHP8 warnings (#9142, #9160)
    - Fix default 'mime.types' path on Windows (#9113)
    - Managesieve: Fix javascript error when relational or spamtest extension is not enabled (#9139)
    - Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6848-1 advisory.

    Matthieu Faou and Denys Klymenko discovered that Roundcube incorrectly handled certain SVG images. A     remote attacker could possibly use this issue to load arbitrary JavaScript code. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-5631)

    Rene Rehme discovered that Roundcube incorrectly handled certain headers. A remote attacker could possibly     use this issue to load arbitrary JavaScript code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04     LTS and Ubuntu 23.10. (CVE-2023-47272)

    Valentin T. and Lutz Wolf discovered that Roundcube incorrectly handled certain SVG images. A remote     attacker could possibly use this issue to load arbitrary JavaScript code. This issue only affected Ubuntu     18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2024-37383)

    Huy Nguyn Phm Nht discovered that Roundcube incorrectly handled certain fields in user     preferences. A remote attacker could possibly use this issue to load arbitrary JavaScript code.
    (CVE-2024-37384)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-562e77957f advisory.

    **Version 1.6.4**

    - Fix PHP8 warnings (#9142, #9160)
    - Fix default 'mime.types' path on Windows (#9113)
    - Managesieve: Fix javascript error when relational or spamtest extension is not enabled (#9139)
    - Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0345-1 advisory.

  - Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail     message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This     could allow a remote attacker to load arbitrary JavaScript code. (CVE-2023-5631)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
114562	Roundcube Webmail 1.6.x < 1.6.4 Cross-Site-Scripting	Web App Scanning	Component Vulnerability	1/17/2025	1/17/2025	medium
114560	Roundcube Webmail < 1.4.15 Cross-Site-Scripting	Web App Scanning	Component Vulnerability	1/17/2025	1/17/2025	medium
114561	Roundcube Webmail 1.5.x < 1.5.5 Cross-Site-Scripting	Web App Scanning	Component Vulnerability	1/17/2025	1/17/2025	medium
183687	Debian DSA-5531-1 : roundcube - security update	Nessus	Debian Local Security Checks	10/23/2023	1/24/2025	medium
183837	Debian dla-3630 : roundcube - security update	Nessus	Debian Local Security Checks	10/24/2023	1/22/2025	medium
183872	Fedora 38 : roundcubemail (2023-955e390a13)	Nessus	Fedora Local Security Checks	10/25/2023	11/14/2024	medium
185190	Fedora 39 : roundcubemail (2023-735ee6d4e1)	Nessus	Fedora Local Security Checks	11/7/2023	11/14/2024	medium
201016	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : Roundcube vulnerabilities (USN-6848-1)	Nessus	Ubuntu Local Security Checks	6/26/2024	10/25/2024	medium
183870	Fedora 37 : roundcubemail (2023-562e77957f)	Nessus	Fedora Local Security Checks	10/25/2023	11/14/2024	medium
184347	openSUSE 15 Security Update : roundcubemail (openSUSE-SU-2023:0345-1)	Nessus	SuSE Local Security Checks	11/3/2023	11/3/2023	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium