Background exploitation KEV catalog No authentication

CVE-2023-5631

Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker…

CheckOps priority index

7.1/10 Patch within 7 days

Severity6.1

Probability7.6

Exploitation4/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 76.3% higher than 99.5% of CVEs

CVSS 3.1 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:

Exploited for 1,104 days 26 Oct 2023

CISA due date 16 Nov 2023 for US federal agencies

Exploitation probability EPSS · FIRST

EPSS probability (%)Percentile among all CVEs

Exploitation signals 4 / 5

KEV catalog (CISA)26 Oct 2023
Exploited in EUVD (ENISA)26 Oct 2023
Used by ransomwareno
EPSS above 10 %76.3%
No account, over the networkyes

What to do

Fix

Apply the vendor’s fix as soon as it is available.

CISA guidance: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Description ENISA EUVD

Affected products

RoundcubemailWebmail

Affected versions

1.6.0 <1.6.3
1.4.0 <1.5.14
1.5.0 <1.5.4

Weaknesses (CWE)

CWE-79

Open source packages OSV

Affected libraries according to OSV, with fixed versions.

Timeline

18 Oct 2023
Published
26 Oct 2023
Exploitation reported (ENISA)
26 Oct 2023
Added to the KEV catalog
16 Nov 2023
CISA remediation due date
19 Oct 2026
EPSS peak: 76.9%

References

Other exploited vulnerabilities from the same vendor

CVE-2025-68461RoundCube Webmail Cross-site Scripting Vulnerability
6.1 · Background exploitation
CVE-2025-49113RoundCube Webmail Deserialization of Untrusted Data Vulnerability
8.7 · Background exploitation
CVE-2024-42009RoundCube Webmail Cross-Site Scripting Vulnerability
8.6 · Background exploitation
CVE-2024-37383RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
7.1 · Background exploitation
CVE-2020-13965Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
7.2 · Background exploitation
CVE-2023-43770Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
6.7 · Background exploitation