CVE-2023-43770

Timeline

Detection, updates, and resolution for this record.

1. Sep 21, 2023 · Catalog

   Detected

   Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

2. Feb 12, 2024 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Mar 4, 2024 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Jun 16, 2026 · Catalog

   Updated

   Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

Affected

• cpe debian/debian linux10.0
• cpe roundcube/webmailversion unspecified
• vendor Roundcube Webmailversion unspecified

Sources

• CISA KEVCVE-2023-43770

  Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.

  cisa.gov
• CVE.orgCVE-2023-43770

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2023-43770

  30-day exploitation probability 63.7%

  first.org
• NIST NVDCVE-2023-43770

  Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

  nvd.nist.gov

References

• Patch · github.com
• Mailing List · lists.debian.org
• CISA note · nvd.nist.gov
• CISA note · roundcube.net
• US Government Resource · cisa.gov