Upstream information

CVE-2023-5631 at MITRE

Description

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker

to load arbitrary JavaScript code.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v3 Scores
	National Vulnerability Database	SUSE
Base Score	5.4	6.1
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector	Network	Network
Attack Complexity	Low	Low
Privileges Required	Low	None
User Interaction	Required	Required
Scope	Changed	Changed
Confidentiality Impact	Low	Low
Integrity Impact	Low	Low
Availability Impact	None	None
CVSSv3 Version	3.1	3.1

SUSE Bugzilla entry: 1216405 [NEW]

SUSE Security Advisories:

openSUSE-SU-2023:0345-1, published Thu Nov 2 18:55:01 2023

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Package Hub 15 SP5	`roundcubemail >= 1.6.4-bp155.2.6.1`	Patchnames: openSUSE-2023-345
openSUSE Leap 15.5	`roundcubemail >= 1.6.4-bp155.2.6.1`	Patchnames: openSUSE-2023-345
openSUSE Tumbleweed	`roundcubemail >= 1.6.4-1.1`	Patchnames: openSUSE-Tumbleweed-2024-13365

SUSE Timeline for this CVE

CVE page created: Wed Oct 18 18:00:28 2023
CVE page last modified: Tue Sep 3 19:28:42 2024