CVE-2023-47272

    Dashboard / Vulnerabilities / CVE-2023-47272

    CVE-2023-47272

    Published: 5 Nov 2023Last Modified: 17 Sept 2026

    Summary:

    Details: Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).

    References: https://github.com/roundcube/roundcubemail/releases/tag/1.5.6, https://github.com/roundcube/roundcubemail/releases/tag/1.6.5, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47272.json, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GILSR762MJB3BNJOVOCMW2JXEPV46IIQ/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFRGBPET73URF6364CI547ZVWQESJLGK/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4F4DUA3Q46ZVB2RD7BFP4XMNS4RYFFQ/, https://nvd.nist.gov/vuln/detail/CVE-2023-47272, https://www.debian.org/security/2023/dsa-5572, https://github.com/roundcube/roundcubemail/commit/5ec496885e18ec6af956e8c0d627856c2257ba2d, https://lists.debian.org/debian-lts-announce/2023/12/msg00005.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- f1d376ba278aa4d9c739a0f3b3961df26cda3c07
    Fixed -5ec496885e18ec6af956e8c0d627856c2257ba2d

    Affected versions

    1.5.5
    1.5.4
    1.5.3
    1.5.2
    1.5.1
    1.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-47272 | CVE-DB