{"answers":{"affected":"","exploited":"There is no known exploitation of openSUSE-SU-2023:0285-1 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"openSUSE-SU-2023:0285-1 is a cross-site scripting vulnerability in roundcubemail, published on 2 Oct 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for openSUSE-SU-2023:0285-1 and fix it if it is affected.\n\nWhat it is: openSUSE-SU-2023:0285-1 is a cross-site scripting vulnerability in roundcubemail, published on 2 Oct 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of openSUSE-SU-2023:0285-1 in the wild and no public exploit code.\n\nAffected product: roundcubemail. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/openSUSE-SU-2023-0285-1/ (Markdown: https://insights.sbomify.com/openSUSE-SU-2023-0285-1/index.md)","id":"openSUSE-SU-2023:0285-1","markdown":"https://insights.sbomify.com/openSUSE-SU-2023-0285-1/index.md","name":"openSUSE-SU-2023:0285-1","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["code_execution","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"Roundcube webmail","requires_auth":"low_privilege","summary":"An XSS vulnerability in Roundcube webmail allows attackers to execute scripts in victim browsers via crafted plain text messages.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"This update for roundcubemail fixes the following issues:\n\nUpdate to 1.6.3 (boo#1215433)\n\n* Fix bug where installto.sh/update.sh scripts were removing some\n  essential options from the config file (#9051)\n* Update jQuery-UI to version 1.13.2 (#9041)\n* Fix regression that broke use_secure_urls feature (#9052)\n* Fix potential PHP fatal error when opening a message with\n  message/rfc822 part (#8953)\n* Fix bug where a duplicate \u003ctitle\u003e tag in HTML email could cause some\n  parts being cut off (#9029)\n* Fix bug where a list of folders could have been sorted\n  incorrectly (#9057)\n* Fix regression where LDAP addressbook 'filter' option was\n  ignored (#9061)\n* Fix wrong order of a multi-folder search result when sorting by\n  size (#9065)\n* Fix so install/update scripts do not require PEAR (#9037)\n* Fix regression where some mail parts could have been decoded\n  incorrectly, or not at all (#9096)\n* Fix handling of an error case in Cyrus IMAP BINARY FETCH, fallback to\n  non-binary FETCH (#9097)\n* Fix PHP8 deprecation warning in the reconnect plugin (#9083)\n* Fix 'Show source' on mobile with x_frame_options = deny (#9084)\n* Fix various PHP warnings (#9098)\n* Fix deprecated use of ldap_connect() in password's ldap_simple driver (#9060)\n* Fix cross-site scripting (XSS) vulnerability in handling of linkrefs\n  in plain text messages\n\nUpdate to 1.6.2\n\n* Add Uyghur localization\n* Fix regression in OAuth request URI caused by use of REQUEST_URI\n  instead of SCRIPT_NAME as a default (#8878)\n* Fix bug where false attachment reminder was displayed on HTML mail\n  with inline images (#8885)\n* Fix bug where a non-ASCII character in app.js could cause error in\n  javascript engine (#8894)\n* Fix JWT decoding with url safe base64 schema (#8890)\n* Fix bug where .wav instead of .mp3 file was used for the new mail\n  notification in Firefox (#8895)\n* Fix PHP8 warning (#8891)\n* Fix support for Windows-31J charset (#8869)\n* Fix so LDAP VLV option is disabled by default as documented (#8833)\n* Fix so an email address with name is supported as input to the managesieve\n  notify :from parameter (#8918)\n* Fix Help plugin menu (#8898)\n* Fix invalid onclick handler on the logo image when using non-array\n  skin_logo setting (#8933)\n* Fix duplicate recipients in 'To' and 'Cc' on reply (#8912)\n* Fix bug where it wasn't possible to scroll lists by clicking middle\n  mouse button (#8942)\n* Fix bug where label text in a single-input dialog could be partially\n  invisible in some locales (#8905)\n* Fix bug where LDAP (fulltext) search didn't work without 'search_fields'\n  in config (#8874)\n* Fix extra leading newlines in plain text converted from HTML (#8973)\n* Fix so recipients with a domain ending with .s are allowed (#8854)\n* Fix so vCard output does not contain non-standard/redundant TYPE=OTHER\n  and TYPE=INTERNET (#8838)\n* Fix QR code images for contacts with non-ASCII characters (#9001)\n* Fix PHP8 warnings when using list_flags and list_cols properties by\n  plugins (#8998)\n* Fix bug where subfolders could loose subscription on parent folder\n  rename (#8892)\n* Fix connecting to LDAP using an URI with ldapi:// scheme (#8990)\n* Fix insecure shell command params handling in cmd_learn driver of markasjunk\n  plugin (#9005)\n* Fix bug where some mail headers didn't work in cmd_learn driver of markasjunk\n  plugin (#9005)\n* Fix PHP fatal error when importing vcf file using PHP 8.2 (#9025)\n* Fix so output of log_date_format with microseconds contains time in server\n  time zone, not UTC","ecosystems":["SUSE:Package Hub 15 SP5","openSUSE:Leap 15.5"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Security update for roundcubemail","id":"openSUSE-SU-2023:0285-1","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":null,"product":null,"products":[],"type":"xss","year":"2023"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"SUSE:Package Hub 15 SP5","fixed":["1.6.3-bp155.2.3.1"],"introduced":["0"],"last_affected":[],"package":"roundcubemail","purl":"pkg:rpm/suse/roundcubemail\u0026distro=SUSE%20Package%20Hub%2015%20SP5","source":"openSUSE-SU-2023:0285-1"},{"ecosystem":"openSUSE:Leap 15.5","fixed":["1.6.3-bp155.2.3.1"],"introduced":["0"],"last_affected":[],"package":"roundcubemail","purl":"pkg:rpm/opensuse/roundcubemail\u0026distro=openSUSE%20Leap%2015.5","source":"openSUSE-SU-2023:0285-1"}],"products":null,"published":"2023-10-02","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"openSUSE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An XSS vulnerability in Roundcube webmail allows attackers to execute scripts in victim browsers via crafted plain text messages.","url":"https://insights.sbomify.com/openSUSE-SU-2023-0285-1/"}