{"id":"CVE-2023-5631","published":"2023-10-18T15:15:08Z","modified":"2026-06-17T06:48:58Z","title":"Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","vendor":"Roundcube","product":"Webmail","tier":"core","eol":null,"description":{"text":"Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker\n\nto load arbitrary JavaScript code.","provenance":"source","from":"NVD"},"summary":{"text":"Roundcube Webmail (Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4) contains a stored cross-site scripting flaw in the HTML sanitisation logic of program/lib/Roundcube/rcube_washtml.php, which mishandles crafted SVG content embedded in HTML e-mail. A remote attacker can exploit this by sending a malicious HTML e-mail containing a crafted SVG document that causes arbitrary JavaScript to execute, requiring the victim to interact with the message (for example, by opening it) and low-privileged access to the application.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:34Z"},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.76337,"percentile":0.99537,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-10-26","dueDate":"2023-11-16","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://roundcube.net/news/2023/10/16/security-update-1.6.4-released, https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15 ;  https://nvd.nist.gov/vuln/detail/CVE-2023-5631","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-10-25","exploitedFirstSeen":"2023-10-25","ransomware":false,"evidence":[{"url":"https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/","date":"2023-10-25"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-10-26"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2024-0217.pdf","date":"2024-02-17"},{"url":"https://www.rewterz.com/rewterz-news/rewterz-threat-alert-russia-linked-winter-vivern-apt-leverages-roundcube-vulnerabilities-to-target-over-80-organizations-active-iocs/","date":"2024-02-20"},{"url":"https://dd80b675424c132b90b3-e48385e382d2e5d17821a5e1d8e4c86b.ssl.cf1.rackcdn.com/external/strategic-analysis-svg-files-abused-in-emerging-campaigns-1.pdf","date":"2024-03-07"},{"url":"https://cofense.com/blog/svg-files-abused-in-emerging-campaigns/","date":"2024-03-13"},{"url":"https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q4-2023-q1-2024.pdf","date":"2024-05-14"},{"url":"https://labs.withsecure.com/publications/mass-exploitation-the-vulnerable-edge-of-enterprise-security","date":"2024-06-12"}],"evidenceTotal":8,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2023/11/01/1","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/01/3","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/17/2","tags":["Mailing List","Third Party Advisory"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079","tags":["Mailing List","Patch"]},{"url":"https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d","tags":["Patch"]},{"url":"https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613","tags":["Patch"]},{"url":"https://github.com/roundcube/roundcubemail/issues/9168","tags":["Exploit","Issue Tracking"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.4.15","tags":["Release Notes"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.5","tags":["Release Notes"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.4","tags":["Release Notes"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LK67Q46OIEGJCRQUBHKLH3IIJTBNGGX4/","tags":["Mailing List"]},{"url":"https://roundcube.net/news/2023/10/16/security-update-1.6.4-released","tags":["Release Notes"]},{"url":"https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15","tags":["Release Notes"]},{"url":"https://www.debian.org/security/2023/dsa-5531","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/01/1","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/01/3","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/17/2","tags":["Mailing List","Third Party Advisory"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079","tags":["Mailing List","Patch"]},{"url":"https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d","tags":["Patch"]},{"url":"https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613","tags":["Patch"]},{"url":"https://github.com/roundcube/roundcubemail/issues/9168","tags":["Exploit","Issue Tracking"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.4.15","tags":["Release Notes"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.5","tags":["Release Notes"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.4","tags":["Release Notes"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LK67Q46OIEGJCRQUBHKLH3IIJTBNGGX4/","tags":["Mailing List"]},{"url":"https://roundcube.net/news/2023/10/16/security-update-1.6.4-released","tags":["Release Notes"]},{"url":"https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15","tags":["Release Notes"]},{"url":"https://www.debian.org/security/2023/dsa-5531","tags":["Mailing List"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5631","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.001","name":"Malicious Link","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Cross-site Scripting (XSS)","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by an adversary via a malicious e-mail containing a crafted SVG document. When a user views the e-mail, the remote attacker can load arbitrary JavaScript code on the victim's machine.  \n\nIn recent campaign Winter Vivern group exploited this vulnerability. The attack chains typically start with a phishing mail sent containing a Base64-encoded payload embedded in the HTML source code. The payload gets decoded and injects a remote javascript, checkupdate.js, in current user session.\n\nThe checkupdate.js script serves as a loader, enabling the execution of a final JavaScript payload which is designed to exfiltrate email messages. The attackers weaponized this XSS flaw to carry out their malicious activities, ultimately allowing them to harvest email messages from their victims' accounts to a C2 server. The attack chain requires minimal user interaction, the attack gets executed only in viewing the malicious email in a web browser.","confidence":"high"},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Cross-site Scripting (XSS)","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited by an adversary via a malicious e-mail containing a crafted SVG document. When a user views the e-mail, the remote attacker can load arbitrary JavaScript code on the victim's machine.  \n\nIn recent campaign Winter Vivern group exploited this vulnerability. The attack chains typically start with a phishing mail sent containing a Base64-encoded payload embedded in the HTML source code. The payload gets decoded and injects a remote javascript, checkupdate.js, in current user session.\n\nThe checkupdate.js script serves as a loader, enabling the execution of a final JavaScript payload which is designed to exfiltrate email messages. The attackers weaponized this XSS flaw to carry out their malicious activities, ultimately allowing them to harvest email messages from their victims' accounts to a C2 server. The attack chain requires minimal user interaction, the attack gets executed only in viewing the malicious email in a web browser.","confidence":"high"},{"id":"T1041","name":"Exfiltration Over C2 Channel","tactics":["exfiltration"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Cross-site Scripting (XSS)","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited by an adversary via a malicious e-mail containing a crafted SVG document. When a user views the e-mail, the remote attacker can load arbitrary JavaScript code on the victim's machine.  \n\nIn recent campaign Winter Vivern group exploited this vulnerability. The attack chains typically start with a phishing mail sent containing a Base64-encoded payload embedded in the HTML source code. The payload gets decoded and injects a remote javascript, checkupdate.js, in current user session.\n\nThe checkupdate.js script serves as a loader, enabling the execution of a final JavaScript payload which is designed to exfiltrate email messages. The attackers weaponized this XSS flaw to carry out their malicious activities, ultimately allowing them to harvest email messages from their victims' accounts to a C2 server. The attack chain requires minimal user interaction, the attack gets executed only in viewing the malicious email in a web browser.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-57924","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57924","exploited":true,"exploitedSince":"2023-10-26","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://github.com/roundcube/roundcubemail/issues/9168"],"flow":[{"stage":"exploitation","techniques":["T1204.001"],"provenance":"source"},{"stage":"primary","techniques":["T1059.007"],"provenance":"source"},{"stage":"secondary","techniques":["T1041"],"provenance":"source"}],"timeline":[{"date":"2023-10-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5631","provenance":"source"},{"date":"2023-10-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/","provenance":"source"},{"date":"2023-10-26","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-10-26","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57924","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":8},"priority":{"score":66.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1101 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9954"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":3.78,"detail":"base score 5.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-roundcube-webmail-cwe-79"}}