6.1

CVE-2023-5631: Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

CVSS: 6.1v3.1MediumKEVAnalyzed
AliasesopenSUSE-SU-2023:0345-1UBUNTU-CVE-2023-5631DEBIAN-CVE-2023-5631
Published 18-10-2023Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2023-5631 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in Roundcube Webmail. It is known to be exploited: CISA lists it, first on 26-10-2023. EPSS estimates a 76.90% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)
EPSS score
76.90%
0%100%
Critical · +1.03 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 2 · Duplicates 1 · Related 1
MGASA-2023-0332USN-6848-1CVE-2023-46267

Timeline

  1. 18-10-2023
    PublishedVulnerability first disclosed.
  2. 26-10-2023
    Added to CISA KEVRoundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
  3. 16-11-2023
    CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

76.90%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+1.03 pp

From 75.87% on 20-09-2026

20-09-202620-10-2026
EPSS score
76.90%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
26-10-2023
Federal due date
16-11-2023

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. nvd.nist.gov/vuln/detail/CVE-2023-5631

Public exploits

1 found
  • githubUnverified

    Roundcubemail

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Debian2 products
  • roundcube< 1.4.15+dfsg.1-1~deb11u1 | < 1.3.17+dfsg.1-1~deb10u4 | < 1.6.4+dfsg-1~deb12u1 | < 1.6.4+dfsg-1
  • debian_linuxEOL10.0 | 11.0 | 12.0
Opensuse2 products
  • roundcubemail&distro=openSUSE Leap 15.5< 1.6.4-bp155.2.6.1
  • roundcubemail&distro=openSUSE Tumbleweed< 1.6.4-1.1
Roundcube2 products
  • roundcubemail≥ 1.6.0, < 1.6.3 | ≥ 1.5.0, < 1.5.4 | ≥ 1.4.0, < 1.5.14
  • webmail< 1.4.15 | ≥ 1.5.0, < 1.5.5 | ≥ 1.6.0, < 1.6.4
Fedoraproject1 product
Suse1 product
  • roundcubemail&distro=SUSE Package Hub 15 SP5< 1.6.4-bp155.2.6.1
Ubuntu1 product
  • roundcube< 1.3.6+dfsg.1-1ubuntu0.1~esm4 | < 1.4.3+dfsg.1-1ubuntu0.1~esm4 | < 1.5.0+dfsg.1-2ubuntu0.1~esm3

6 vendors · 9 products

References

24 links
Show all 24 references