Roundcube webmail XSS vulnerability exploited by attackers (CVE-2023-43770)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-35730 | Cross-Site Scripting in Roundcube Webmail Plain-Text Email Link Handling | 6.1 | 33% | KEV | KEV |
| CVE-2021-44026 | SQL Injection in Roundcube Webmail via Search Parameters | 9.8 | 70% | KEV | KEV |
| CVE-2023-43770 | Persistent Cross-Site Scripting in Roundcube Webmail (Exploited in the Wild) | 6.1 | 64% | KEV | KEV |
From the original article
1 min read at helpnetsecurity.com
CVE-2023-43770, a vulnerability in the Roundcube webmail software that has been fixed in September 2023, is being exploited by attackers in the wild, CISA has warned by adding the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. Roundcube is an open-source, browser-based IMAP client with an application-like user interface.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.