Medium severity6.1CISA KEVNVD Advisory· Published Sep 22, 2023· Updated Jun 17, 2026

CVE-2023-43770

Description

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Roundcube/Webmail
cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
Range: <1.4.14
Debian/linux
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Roundcube/Roundcubemailcpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <1.4.14, <1.5.4, <1.6.3
osv-coords
pkg:bitnami/roundcube
Range: < 1.4.14

Patches

Vulnerability mechanics

References

github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49bnvdPatch
lists.debian.org/debian-lts-announce/2023/09/msg00024.htmlnvdMailing List
roundcube.net/news/2023/09/15/security-update-1.6.3-releasednvdRelease Notes
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.047
exploit	0.000
kev	0.120
patch	0.000
ransomware	0.000