Exploit / PoCcritical

Roundcube webmail zero-day exploited to spy on government entities (CVE-2023-5631)

Help Net Securityby @zeljkazorzOct 25, 2023 · 00:00 UTC (Oct 25, 2023)1 min read1 · 1 read

Read at helpnetsecurity.com

Analyze CVE-2023-5631 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2023-5631 CVE-2020-35730 CVE-2022-27926

Tags: cve-2023-5631 cve-2020-35730 cve-2022-27926 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2020-35730	Cross-Site Scripting in Roundcube Webmail Plain-Text Email Link Handling	6.1	33%	KEV	Dec 28, 2020 KEV Jun 22, 2023
CVE-2022-27926	Reflected XSS in Synacor Zimbra Collaboration Suite 9.0 (launchNewWindow.jsp)	6.1	18%	KEV	Apr 21, 2022 KEV Apr 3, 2023
CVE-2023-5631	Stored XSS in Roundcube Webmail exploited in the wild (CVE-2023-5631)	5.4	76%	KEVPoC	Oct 18, 2023 KEV Oct 26, 2023

From the original article

1 min read at helpnetsecurity.com

The Winter Vivern APT group has been exploiting a zero-day vulnerability (CVE-2023-5631) in Roundcube webmail servers to spy on email communications of European governmental entities and a think tank, according to ESET researchers. “Exploitation of the XSS vulnerability can be done remotely by sending a specially crafted email message,” the researchers noted.

Help Net Security

By @zeljkazorz · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.