CISA Warns About Exploitation of Roundcube Vulnerability in Cyber Attacks
CISA warned that a security vulnerability patched in September 2023 in Roundcube's email server is actively being used in cyberattacks.
CISA issued a warning that the security vulnerability in the Roundcube email server, identified as CVE-2023-43770, is being actively exploited in cross-site scripting attacks.
The vulnerability allows cyber attackers to gain limited access through malicious text links in low-complexity attacks that require user interaction. The vulnerability affects Roundcube mail servers running versions 1.4.14 or higher, 1.5.x before 1.5.4, and 1.6.x before 1.6.3.
In September, the Roundcube security team recommended that all Roundcube installations upgrade to the latest version. CISA added the vulnerability to its catalog of known security vulnerabilities, warning that it is a "common attack vector" and poses a "significant risk" to U.S. federal agencies without disclosing details of the attacks.
Source: CISA Warns About Roundcube Bug Exploitation in Cyber Attacks (itsecurity.pt)