erroneo.us
Search all guides⌘K

Digest · Friday

Security digest: September 15, 2023

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: Roundcube CVE-2023-43770: Plain-Text Email XSS, Exploited. Anyone running Roundcube older than 1.6.3, 1.5.4 or 1.4.14, including copies bundled in hosting panels or old distribution packages, and anyone still on the unsupported 1.4 or 1.5 branches.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2023-43770

Roundcube CVE-2023-43770: Plain-Text Email XSS, Exploited

Patched in September 2023 and used by a Russia-linked espionage campaign within two weeks; confirm every Roundcube is on 1.6.20 or 1.7.5, and if an old install was exposed in 2023 or 2024, look for mail-forwarding rules that an upgrade does not remove.

Must act: Anyone running Roundcube older than 1.6.3, 1.5.4 or 1.4.14, including copies bundled in hosting panels or old distribution packages, and anyone still on the unsupported 1.4 or 1.5 branches.

Can relax: Installs kept current on Roundcube 1.6.x or 1.7.x, and organizations that do not run Roundcube.

  1. Inventory every Roundcube instance, including hosting-panel bundles, and record its version.
  2. Upgrade to Roundcube 1.6.20 or 1.7.5; 1.6.3 is only the floor for this bug.
  3. Move any 1.4 or 1.5 install to 1.6 or 1.7, since those branches no longer get fixes.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.