CVE-2023-43770

Summary

CVE-2023-43770 is a vulnerability affecting Roundcube email client versions before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3. Maliciously crafted text/plain e-mail messages with links can exploit this issue through the program/lib/Roundcube/rcube_string_replacer.php file. The flaw allows attackers to inject and execute malicious code in users' browsers, potentially leading to session hijacking or data theft. Users are advised to update their Roundcube installations as soon as possible to mitigate this cross-site scripting (XSS) risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.