CVE-2024-37384
published 2024-06-07CVE-2024-37384: Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.
PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.50%
38.9th percentile
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | roundcube | < roundcube 1.6.5+dfsg-1+deb12u2 (bookworm) | roundcube 1.6.5+dfsg-1+deb12u2 (bookworm) |
| roundcube | webmail | < 1.5.7 | 1.5.7 |
| roundcube | webmail | >= 1.6.0 < 1.6.7 | 1.6.7 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv6.1MEDIUM
vendor_debian6.1MEDIUM
vendor_ubuntu6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Roundcube vulnerabilities
vendor_ubuntu·2024-06-25·CVSS 6.1
CVE-2024-37383 [MEDIUM] Roundcube vulnerabilities
Title: Roundcube vulnerabilities
Summary: Roundcube could be made to crash or run programs if it received specially
crafted input.
Matthieu Faou and Denys Klymenko discovered that Roundcube incorrectly
handled certain SVG images. A remote attacker could possibly use this
issue to load arbitrary JavaScript code. This issue only affected Ubuntu
18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10.
(CVE-2023-5631)
Rene Rehme discovered that Roundcube incorrectly handled certain headers.
A remote attacker could possibly use this issue to load arbitrary
JavaScript code. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-47272)
Valentin T. and Lutz Wolf discovered that Roundcube incorrectly handled
certain SVG images. A remote attacker could pos
Debian
CVE-2024-37384: roundcube - Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list column...
vendor_debian·2024·CVSS 6.1
CVE-2024-37384 [MEDIUM] CVE-2024-37384: roundcube - Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list column...
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.
Scope: local
bookworm: resolved (fixed in 1.6.5+dfsg-1+deb12u2)
bullseye: resolved (fixed in 1.4.15+dfsg.1-1+deb11u3)
forky: resolved (fixed in 1.6.7+dfsg-1)
sid: resolved (fixed in 1.6.7+dfsg-1)
trixie: resolved (fixed in 1.6.7+dfsg-1)
OSV
roundcube vulnerabilities
osv·2024-06-25·CVSS 6.1
CVE-2023-5631 [MEDIUM] roundcube vulnerabilities
roundcube vulnerabilities
Matthieu Faou and Denys Klymenko discovered that Roundcube incorrectly
handled certain SVG images. A remote attacker could possibly use this
issue to load arbitrary JavaScript code. This issue only affected Ubuntu
18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10.
(CVE-2023-5631)
Rene Rehme discovered that Roundcube incorrectly handled certain headers.
A remote attacker could possibly use this issue to load arbitrary
JavaScript code. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-47272)
Valentin T. and Lutz Wolf discovered that Roundcube incorrectly handled
certain SVG images. A remote attacker could possibly use this issue to
load arbitrary JavaScript code. This issue only affected Ubuntu 18.04 LTS,
Ubuntu
GHSA
GHSA-r96m-mwvr-946h: Roundcube Webmail before 1
ghsa_unreviewed·2024-06-07
CVE-2024-37384 [MEDIUM] CWE-79 GHSA-r96m-mwvr-946h: Roundcube Webmail before 1
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.
OSV
CVE-2024-37384: Roundcube Webmail before 1
osv·2024-06-07·CVSS 6.1
CVE-2024-37384 [MEDIUM] CVE-2024-37384: Roundcube Webmail before 1
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7https://github.com/roundcube/roundcubemail/releases/tag/1.5.7https://github.com/roundcube/roundcubemail/releases/tag/1.6.7https://lists.debian.org/debian-lts-announce/2024/06/msg00008.htmlhttps://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7https://github.com/roundcube/roundcubemail/releases/tag/1.5.7https://github.com/roundcube/roundcubemail/releases/tag/1.6.7https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html
2024-06-07
Published