{"id":"CVE-2023-47272","details":"Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).","aliases":["BIT-roundcube-2023-47272"],"modified":"2026-04-16T04:38:03.822666874Z","published":"2023-11-06T00:15:09.380Z","related":["openSUSE-SU-2024:0257-1","openSUSE-SU-2024:13401-1"],"references":[{"type":"ADVISORY","url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.5"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00005.html"},{"type":"ADVISORY","url":"https://www.debian.org/security/2023/dsa-5572"},{"type":"ADVISORY","url":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.6"},{"type":"FIX","url":"https://github.com/roundcube/roundcubemail/commit/5ec496885e18ec6af956e8c0d627856c2257ba2d"},{"type":"ARTICLE","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GILSR762MJB3BNJOVOCMW2JXEPV46IIQ/"},{"type":"ARTICLE","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFRGBPET73URF6364CI547ZVWQESJLGK/"},{"type":"ARTICLE","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4F4DUA3Q46ZVB2RD7BFP4XMNS4RYFFQ/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/roundcube/roundcubemail","events":[{"introduced":"f1d376ba278aa4d9c739a0f3b3961df26cda3c07"},{"fixed":"5ec496885e18ec6af956e8c0d627856c2257ba2d"},{"introduced":"993b888afe29c383bf45c84f17090f4db96367ba"},{"fixed":"81ac3c342a4f288deb275590895b52ec3785cf8a"}],"database_specific":{"versions":[{"introduced":"1.5.0"},{"fixed":"1.5.6"},{"introduced":"1.6.0"},{"fixed":"1.6.5"}]}}],"versions":["1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-47272.json","unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"37"}]},{"events":[{"introduced":"0"},{"last_affected":"38"}]},{"events":[{"introduced":"0"},{"last_affected":"39"}]},{"events":[{"introduced":"0"},{"last_affected":"10.0"}]},{"events":[{"introduced":"0"},{"last_affected":"11.0"}]},{"events":[{"introduced":"0"},{"last_affected":"12.0"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}