Upstream information

CVE-2023-5631 at MITRE

Description

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v3 Scores
  National Vulnerability Database SUSE
Base Score 5.4 6.1
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network Network
Attack Complexity Low Low
Privileges Required Low None
User Interaction Required Required
Scope Changed Changed
Confidentiality Impact Low Low
Integrity Impact Low Low
Availability Impact None None
CVSSv3 Version 3.1 3.1
SUSE Bugzilla entry: 1216405 [NEW]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Package Hub 15 SP5
  • roundcubemail >= 1.6.4-bp155.2.6.1
 Patchnames:
openSUSE-2023-345
openSUSE Leap 15.5
  • roundcubemail >= 1.6.4-bp155.2.6.1
 Patchnames:
openSUSE-2023-345
openSUSE Tumbleweed
  • roundcubemail >= 1.6.4-1.1
 Patchnames:
openSUSE Tumbleweed GA roundcubemail-1.6.4-1.1

SUSE Timeline for this CVE

CVE page created: Wed Oct 18 18:00:28 2023
CVE page last modified: Fri Nov 17 19:31:59 2023