CVE-2024-37383
roundcube webmail
Published 7 Jun 2024 · updated 17 Jun 2026 · Analyzed
6.1 Medium · CVSS 3.1, NVD
Exploited in the wild
CISA added this to its Known Exploited Vulnerabilities catalog on 24 Oct 2024, with a remediation deadline of 14 Nov 2024 for US federal agencies.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
References
- github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242 · Patch
- github.com/roundcube/roundcubemail/releases/tag/1.5.7 · Release Notes
- github.com/roundcube/roundcubemail/releases/tag/1.6.7 · Release Notes
- lists.debian.org/debian-lts-announce/2024/06/msg00008.html · Mailing List, Third Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-37383 · US Government Resource