CVSS 3.1 Score 6.1 of 10 (medium)


Published Sep 22, 2023
Updated: Feb 13, 2024


CVE-2023-43770 is a vulnerability that affects Roundcube versions before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3. This vulnerability allows for cross-site scripting (XSS) attacks through crafted links in text/plain email messages due to the behavior of the program/lib/Roundcube/rcube_string_replacer.php file. The potential danger it poses to organizations is a medium severity level with a base score of 6.1 out of 10, as determined by NIST's CVSS scoring system. To remediate this vulnerability, organizations should update their Roundcube installations to version 1.4.14, 1.5.4, or 1.6.3 or later versions to mitigate the risk of XSS attacks exploiting this vulnerability.

Note: The information provided is based on the given data and may not provide a comprehensive analysis of the vulnerability's impact or remediation steps required in specific environments or configurations

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-43770 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options