CVE-2023-43770: Roundcube Webmail cross-site scripting, used for credential theft
The short version: Roundcube Webmail has a cross-site scripting flaw (CVE-2023-43770) in how it handles links inside plaintext email messages. A crafted message can run attacker script in the mailbox of whoever opens it — enough to steal session data and phish credentials from inside a trusted interface. It's in CISA's KEV catalog, and the fix is a straightforward upgrade. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — see below |
| CVSS v3.1 (NVD) | 6.1 — Medium · AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| EPSS | 58.48% · 99th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2024-03-04 |
| Known exploited? | Yes — listed as a known-exploited XSS |
| Vulnerability type | CWE-79 cross-site scripting (persistent) → session/credential theft |
| Requires authenticated session? | No for the attacker — a logged-in victim must open the crafted message (UI:R) |
| Affected | Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 |
| Fixed in | 1.4.14 · 1.5.4 · 1.6.3 |
What you need to know
The bug is in rcube_string_replacer.php, which rewrites links in plaintext messages. A crafted link slips past sanitization, so opening the email executes attacker-controlled JavaScript inside the victim's Roundcube session.
- Delivery is trivial — it's email. The attacker just needs to get a message in front of a user; no access to your systems required.
- The payoff is the session. Script running in webmail can read what the user sees, manipulate the interface, and drop a convincing fake login to harvest the password.
- It's a stepping stone. Stolen webmail access feeds phishing, business-email-compromise, and follow-on attacks like the authenticated bugs elsewhere in Roundcube's history.
How serious we see it
High — and we'll say plainly when the context makes it worse.
The 6.1 is fair: this is user-interaction XSS with limited direct impact, not remote code execution. What earns the KEV listing — and our attention — is how reliably webmail XSS converts into credential theft and account takeover in real campaigns. The reassuring part is that it's bounded and fixed: specific versions, a published patch, and quick to confirm. Patch it and the door closes.
Recommendations
Straight from Roundcube's advisory and CISA:
- Patch now. Upgrade to 1.6.3, 1.5.4, or 1.4.14 (or later).
- Enforce MFA on webmail. It blunts the credential-theft payoff even if a session is briefly abused.
- Restrict exposure. Keep the Roundcube host reachable only where it must be.
- Educate on session anomalies. Unexpected re-login prompts inside webmail are worth a report.
- Confirm your exposure first. Verify whether an internet-facing Roundcube instance exists and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing Roundcube from little more than your domain, fingerprints the version, and flags exposure tied to KEV-listed vulnerabilities like this one, ranked up because it's actively exploited. We identify and flag the affected version; we don't deliver the payload. The outside-in view means an exposed, unpatched Roundcube is already on your radar rather than waiting to be discovered by an attacker's email.