CVE-2024-37383

Description

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

Scoring

• CVSS: 6.1 (MEDIUM, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2024-10-24
• Remediation due date: 2024-11-14
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-79
• CWE-79

References

• https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.7
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.7
• https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html
• https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.7
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.7
• https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-37383

More from Roundcube

• CVE-2025-49113 — Webmail
• CVE-2025-68461 — Webmail
• CVE-2024-42009 — Webmail
• CVE-2020-13965 — Webmail
• CVE-2023-43770 — Webmail