CVE-2023-5631

CVE-2023-5631 is a software vulnerability that was identified and reported by ESET CNA on October 18, 2023. This flaw exists in the design or implementation of Roundcube webmail servers. The vulnerability can be exploited through specially crafted email messages, posing significant security risks. The Advanced Persistent Threat (APT) group known as Winter Vivern has been exploiting this zero-day vulnerability to infiltrate and spy on European governmental entities and a think tank. Their activities have been extensively analyzed, revealing a sophisticated attack sequence which leverages CVE-2023-5631 to gain unauthorized access to sensitive information. This discovery underscores the persistent threat posed by Winter Vivern, particularly in light of their exploitation of the Roundcube zero-day vulnerability. It highlights the necessity for prompt action to address such vulnerabilities, given their potential misuse by malicious actors targeting government institutions and other high-profile organizations.