🛡 H3lium@infosec.exchange/:~# :blinking_cursor:​<p>"🚨 <a href="https://infosec.exchange/tags/RoundCubeUnderSiege" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RoundCubeUnderSiege</span></a> - CISA Alerts on Roundcube as a frequent attack vector. 🚨"</p><p>The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about active exploitation of a vulnerability in the RoundCube webmail software. Attackers are leveraging this flaw to execute arbitrary code on vulnerable servers. This Medium vulnerability, identified as CVE-2023-43770 (CVSS score: 6.1), allows attackers XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior on Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 .🔐💻</p><p>Tags: <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CISA</span></a> <a href="https://infosec.exchange/tags/RoundCube" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RoundCube</span></a> <a href="https://infosec.exchange/tags/EmailSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EmailSecurity</span></a> <a href="https://infosec.exchange/tags/VulnerabilityManagement" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>VulnerabilityManagement</span></a> <a href="https://infosec.exchange/tags/PatchManagement" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PatchManagement</span></a> <a href="https://infosec.exchange/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatIntelligence</span></a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>InfoSec</span></a></p><p>Source: <a href="https://www.cisa.gov/news-events/alerts/2024/02/12/cisa-adds-one-known-exploited-vulnerability-catalog" rel="nofollow noopener" target="_blank">Cisa.gov</a></p>