{"id":"BIT-roundcube-2023-47272","details":"Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).","aliases":["CVE-2023-47272"],"modified":"2024-03-06T11:25:28.861Z","published":"2024-03-06T11:04:04.305Z","database_specific":{"severity":"Medium","cpes":["cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*"]},"references":[{"type":"WEB","url":"https://github.com/roundcube/roundcubemail/commit/5ec496885e18ec6af956e8c0d627856c2257ba2d"},{"type":"WEB","url":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.6"},{"type":"WEB","url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.5"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00005.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GILSR762MJB3BNJOVOCMW2JXEPV46IIQ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFRGBPET73URF6364CI547ZVWQESJLGK/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4F4DUA3Q46ZVB2RD7BFP4XMNS4RYFFQ/"},{"type":"WEB","url":"https://www.debian.org/security/2023/dsa-5572"}],"affected":[{"package":{"name":"roundcube","ecosystem":"Bitnami","purl":"pkg:bitnami/roundcube"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.5.0"},{"fixed":"1.5.6"},{"introduced":"1.6.0"},{"fixed":"1.6.5"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/roundcube/BIT-roundcube-2023-47272.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}],"schema_version":"1.7.3"}