CVE-2024-37383

MediumCVSS 6.1/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
roundcube	webmail	< 1.5.7; >= 1.6.0, < 1.6.7
roundcube	webmail	< 1.5.7; >= 1.6.0, < 1.6.7

References

https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242Patch
https://github.com/roundcube/roundcubemail/releases/tag/1.5.7Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.6.7Release Notes
https://lists.debian.org/debian-lts-announce/2024/06/msg00008.htmlMailing List, Third Party Advisory
https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242Patch
https://github.com/roundcube/roundcubemail/releases/tag/1.5.7Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.6.7Release Notes
https://lists.debian.org/debian-lts-announce/2024/06/msg00008.htmlMailing List, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-37383US Government Resource

Timeline

Published: Jun 7, 2024
Last modified: Jun 17, 2026
Added to CISA KEV: Oct 24, 2024
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-373846.1Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.CVE-2024-373859.8Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: th CVE-2024-373864.2An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.25, 4.4.0 through 4.7.5, and 4.8.0. Certain manipulations al CVE-2024-373874.0Use of potentially dangerous function issue exists in Ricoh Streamline NX PC Client. If this vulnerability is exploited, files in the PC whe CVE-2024-373889.1An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitive CVE-2024-373895.4Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is v CVE-2024-37399.8A vulnerability classified as critical was found in cym1102 nginxWebUI up to 3.9.9. This vulnerability affects unknown code of the file /adm CVE-2024-373917.8ProtonVPN before 3.2.10 on Windows mishandles the drive installer path, which should use this: '"' + ExpandConstant('{autopf}\Proton\Drive')CVE-2024-373926.1A stored Cross-Site Scripting (XSS) vulnerability has been identified in SMSEagle software version < 6.0. The vulnerability arises because t CVE-2024-373937.5Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauth CVE-2024-373945.4A stored cross-site scripting (XSS) vulnerability in the Project Dashboards of REDCap 13.1.9 allows authenticated users to execute arbitrary CVE-2024-373955.4A stored cross-site scripting (XSS) vulnerability in the Public Survey function of REDCap 13.1.9 allows authenticated users to execute arbit