{"id":"CVE-2023-43770","published":"2023-09-22T06:15:10Z","modified":"2026-06-17T06:26:24Z","title":"Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","vendor":"Roundcube","product":"Webmail","tier":"core","eol":null,"description":{"text":"Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.","provenance":"source","from":"NVD"},"summary":{"text":"The Roundcube Webmail product contains a persistent cross-site scripting flaw in its message handling, located in the rcube_string_replacer.php component of the library code, affecting versions before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3. An unauthenticated remote attacker can send a text/plain e-mail containing crafted links that cause script to execute in the victim's browser when the user interacts with the message, such as by opening it.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:37Z"},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.6366,"percentile":0.99215,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2024-02-12","dueDate":"2024-03-04","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://roundcube.net/news/2023/09/15/security-update-1.6.3-released ;  https://nvd.nist.gov/vuln/detail/CVE-2023-43770","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-02-12","exploitedFirstSeen":"2024-02-12","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-02-12"},{"url":"https://cert.gov.ua/article/6281123","date":"2024-10-25"},{"url":"https://www.welivesecurity.com/en/eset-research/operation-roundpress/","date":"2025-05-15"},{"url":"https://blog.polyswarm.io/fancy-bears-spypress-malware","date":"2025-05-23"},{"url":"https://cyble.com/blog/critical-it-vulnerabilities-flagged-in-cyble-report/","date":"2025-05-23"},{"url":"https://www.cyfirma.com/research/apt-profile-fancy-bear-2/","date":"2025-07-16"},{"url":"https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf","date":"2025-10-09"},{"url":"https://www.picussecurity.com/resource/blog/apt28-cyber-threat-profile-and-detailed-ttps","date":"2025-12-10"},{"url":"https://ctrlaltintel.com/research/FancyBear/","date":"2026-03-15"},{"url":"https://socradar.io/wp-content/uploads/2026/07/NATO-Threat-Landscape-Report-2026.pdf","date":"2026-07-10"}],"evidenceTotal":11,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49b","tags":["Patch"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00024.html","tags":["Mailing List"]},{"url":"https://roundcube.net/news/2023/09/15/security-update-1.6.3-released","tags":["Release Notes"]},{"url":"https://github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49b","tags":["Patch"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00024.html","tags":["Mailing List"]},{"url":"https://roundcube.net/news/2023/09/15/security-update-1.6.3-released","tags":["Release Notes"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43770","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Cross-site Scripting (XSS)","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by an adversary via malicious links embedded in trustworthy websites to infiltrate victim systems. Successful exploitation grants the adversary the ability to execute arbitrary code on the impacted system. \n\nThe Russia-aligned hacking group TAG-70 has been attributed to exploiting this vulnerability. TAG-70 has used this vulnerability in an espionage campaign targeting European government and military agencies, as well as Iranian embassies in Russia, aiming to gather intelligence on European political and military activities. The campaign, active from early to mid-October 2023, is part of a broader pattern of Russian state-aligned cyber-espionage targeting email services.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Cross-site Scripting (XSS)","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited by an adversary via malicious links embedded in trustworthy websites to infiltrate victim systems. Successful exploitation grants the adversary the ability to execute arbitrary code on the impacted system. \n\nThe Russia-aligned hacking group TAG-70 has been attributed to exploiting this vulnerability. TAG-70 has used this vulnerability in an espionage campaign targeting European government and military agencies, as well as Iranian embassies in Russia, aiming to gather intelligence on European political and military activities. The campaign, active from early to mid-October 2023, is part of a broader pattern of Russian state-aligned cyber-espionage targeting email services.","confidence":"high"},{"id":"T1082","name":"System Information Discovery","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Cross-site Scripting (XSS)","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited by an adversary via malicious links embedded in trustworthy websites to infiltrate victim systems. Successful exploitation grants the adversary the ability to execute arbitrary code on the impacted system. \n\nThe Russia-aligned hacking group TAG-70 has been attributed to exploiting this vulnerability. TAG-70 has used this vulnerability in an espionage campaign targeting European government and military agencies, as well as Iranian embassies in Russia, aiming to gather intelligence on European political and military activities. The campaign, active from early to mid-October 2023, is part of a broader pattern of Russian state-aligned cyber-espionage targeting email services.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-48147","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-48147","exploited":true,"exploitedSince":"2024-02-12","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2023-09-27","earliestUrl":"https://github.com/s3cb0y/CVE-2023-43770-POC","repos":[{"name":"s3cb0y/CVE-2023-43770-POC","url":"https://github.com/s3cb0y/CVE-2023-43770-POC","stars":35,"created":"2023-09-27"},{"name":"knight0x07/CVE-2023-43770-PoC","url":"https://github.com/knight0x07/CVE-2023-43770-PoC","stars":3,"created":"2023-09-28"},{"name":"skyllpro/CVE-2021-44026-PoC","url":"https://github.com/skyllpro/CVE-2021-44026-PoC","stars":0,"created":"2025-04-20"}]},"first":{"date":"2023-09-27","source":"PoC-in-GitHub","url":"https://github.com/s3cb0y/CVE-2023-43770-POC"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1189"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1082"],"provenance":"source"}],"timeline":[{"date":"2023-09-22","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43770","provenance":"source"},{"date":"2023-09-27","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/s3cb0y/CVE-2023-43770-POC","provenance":"source"},{"date":"2024-02-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2024-02-12","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-02-12","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-48147","provenance":"source"}],"speed":{"daysToPublicExploit":5,"firstExploitFrom":"PoC-in-GitHub","daysToKev":143},"priority":{"score":67.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 992 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.84,"detail":"percentile 0.9921"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.27,"detail":"base score 6.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-roundcube-webmail-cwe-79"}}