CVE-2023-46267: XSS
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows XSS via a text/html e-mail message containing an SVG image with a USE element. This is related to washuri in rcubewashtml.php.
Other sources
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-5631. Reason: This candidate is a duplicate of CVE-2023-5631. Notes: All CVE users should reference CVE-2023-5631 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-46267?
CVE-2023-46267 has a medium severity rating due to its potential for XSS attacks through specially crafted email messages.
How do I fix CVE-2023-46267?
To fix CVE-2023-46267, upgrade to Roundcube versions 1.4.15, 1.5.5, or 1.6.4 or later.
What type of vulnerability is CVE-2023-46267?
CVE-2023-46267 is an XSS vulnerability that can be exploited via SVG images in email messages.
Which versions of Roundcube are affected by CVE-2023-46267?
Affected versions include Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4.
What should I do if I cannot update to the fixed versions for CVE-2023-46267?
If unable to update, consider implementing content security policies or disabling HTML emails to mitigate risks from CVE-2023-46267.