CVE-2023-47272

Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).

• CWE-79

• https://github.com/roundcube/roundcubemail/commit/5ec496885e18ec6af956e8c0d627856c2257ba2dPatch
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.6Release Notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.5Release Notes
• https://lists.debian.org/debian-lts-announce/2023/12/msg00005.htmlThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GILSR762MJB3BNJOVOCMW2JXEPV46IIQ/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFRGBPET73URF6364CI547ZVWQESJLGK/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4F4DUA3Q46ZVB2RD7BFP4XMNS4RYFFQ/Mailing List
• https://www.debian.org/security/2023/dsa-5572Third Party Advisory
• https://github.com/roundcube/roundcubemail/commit/5ec496885e18ec6af956e8c0d627856c2257ba2dPatch
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.6Release Notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.5Release Notes
• https://lists.debian.org/debian-lts-announce/2023/12/msg00005.htmlThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GILSR762MJB3BNJOVOCMW2JXEPV46IIQ/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFRGBPET73URF6364CI547ZVWQESJLGK/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4F4DUA3Q46ZVB2RD7BFP4XMNS4RYFFQ/Mailing List
• https://www.debian.org/security/2023/dsa-5572Third Party Advisory

Published

Nov 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-47264Certain WithSecure products have a buffer over-read whereby …7.5
• CVE-2023-47265Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XS…5.4
• CVE-2023-47267An issue discovered in TheGreenBow Windows Enterprise Certif…9.8
• CVE-2023-47268In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer th…5.3
• CVE-2023-4727A flaw was found in dogtag-pki and pki-core. The token authe…7.5
• CVE-2023-47271PKP-WAL (aka PKP Web Application Library or pkp-lib) before …5.3
• CVE-2023-47279In Delta Electronics InfraSuite Device Master v.1.0.7, A vul…7.5
• CVE-2023-4728The LadiApp plugin for WordPress is vulnerable to unauthoriz…5.4
• CVE-2023-47282Out-of-bounds write in Intel(R) Media SDK all versions and s…3.9
• CVE-2023-47283Directory traversal vulnerability in CubeCart prior to 6.5.3…4.9
• CVE-2023-4729The LadiApp plugin for WordPress is vulnerable to Cross-Site…4.3
• CVE-2023-47294An issue in NCR Terminal Handler v1.5.1 allows low-level pri…8.1