⚠ Actively exploited
Added to CISA KEV on 2024-10-24. Federal agencies required to patch by 2024-11-14. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable..

CVE-2024-37383 — Cross-site Scripting in Webmail

CWE-79 — Cross-site Scripting12 documents12 sources
Severity
6.1MEDIUMNVD
EPSS
64.0%
top 1.56%
CISA KEV
KEV
Added 2024-10-24
Due 2024-11-14
Exploit
Exploited in wild
Active exploitation observed
Affected products
2
Roundcube WebmailDebian Linux
Timeline
PublishedJun 7
KEV addedOct 24
KEV dueNov 14
Latest updateJan 8
CISA Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

▶NVDroundcube/webmail1.6.0 — 1.6.7+1

Also affects: Debian Linux 10.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-8j3w-26mp-75xh: Roundcube Webmail before 1↗2024-06-07
▶
OSV
CVE-2024-37383: Roundcube Webmail before 1↗2024-06-07
▶
CVEList
CVE-2024-37383: Roundcube Webmail before 1↗2024-06-07
▶
VulnCheck
RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability↗2024
▶

💥Exploits & PoCs

1
Exploit-DB
Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS)↗2025-04-11
▶

🔍Detection Rules

1
Suricata
ET EXPLOIT Roundcube XSS via SVG Animate Attributes (CVE-2024-37383)↗2026-01-08
▶

📋Vendor Advisories

4
CISA
RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability↗2024-10-24
▶
Ubuntu
Roundcube vulnerabilities↗2024-06-25
▶
Red Hat
roundcubemail: allows XSS via SVG animate attributes↗2024-06-07
▶
Debian
CVE-2024-37383: roundcube - Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate...↗2024
▶

🕵️Threat Intelligence

1
Bleepingcomputer
Hackers exploit Roundcube webmail flaw to steal email, credentials↗2024-10-21
▶
CVE-2024-37383 — Cross-site Scripting in Webmail | cvebase