Actively exploited · Published Jun 7, 2024 · Assigned by mitre
CVE-2024-37383
Medium 6.1 Exploited
In plain English
A medium-severity cross-site scripting in Webmail from Roundcube. Attackers are actively exploiting it in the wild (listed by CISA on October 24, 2024). The chance it is exploited in the next 30 days is estimated at 74.0% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Nov 14, 2024.
Official description
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | roundcube | 1.6.5+dfsg-1+deb12u2 | DEBIAN-CVE-2024-37383 |
| Debian:12 | roundcube | 1.6.5+dfsg-1+deb12u2 | DSA-5714-1 |
| Debian:13 | roundcube | 1.6.7+dfsg-1 | DEBIAN-CVE-2024-37383 |
| Debian:14 | roundcube | 1.6.7+dfsg-1 | DEBIAN-CVE-2024-37383 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.7
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.7
- [debian-lts-announce] 20240617 [SECURITY] [DLA 3835-1] roundcube security update mailing-list
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-37383 government-resource