CVE-2024-37383
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
- Record
CVE-2024-37383- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
- Record
CVE-2024-37383- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-36625
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
- Record
EUVD-2024-36625- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8j3w-26mp-75xh
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
- Record
GHSA-8j3w-26mp-75xh- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CISA KEV No score
RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.
- Record
CVE-2024-37383- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
- Record
CVE-2024-37383- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-37383
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
- Record
DEBIAN-CVE-2024-37383- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-37383
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
- Record
UBUNTU-CVE-2024-37383- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUSN-6848-1 No score
roundcube vulnerabilities
Matthieu Faou and Denys Klymenko discovered that Roundcube incorrectly handled certain SVG images. A remote attacker could possibly use this issue to load arbitrary JavaScript code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-5631)
Rene Rehme discovered that Roundcube incorrectly handled certain headers. A remote attacker could possibly use this issue to load arbitrary JavaScript code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-47272)
Valentin T. and Lutz Wolf discovered that Roundcube incorrectly handled certain SVG images. A remote attacker could possibly use this issue to load arbitrary JavaScript code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2024-37383)
Huy Nguyễn Phạm Nhật discovered that Roundcube incorrectly handled certain fields in user preferences. A remote attacker could possibly use this issue to load arbitrary JavaScript code. (CVE-2024-37384)
- Record
USN-6848-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
roundcubeDebian:12 |
before 1.6.5+dfsg-1+deb12u2, plus listed versions 1.6.1+dfsg-11.6.2+dfsg-11.6.3+dfsg-11.6.3+dfsg-1~deb12u11.6.3+dfsg-2 Show 4 moreShow less1.6.4+dfsg-11.6.4+dfsg-1~deb12u11.6.5+dfsg-11.6.5+dfsg-1~deb12u1 |
1.6.5+dfsg-1+deb12u2 |
roundcubeDebian:13 |
before 1.6.7+dfsg-1 | 1.6.7+dfsg-1 |
roundcubeDebian:14 |
before 1.6.7+dfsg-1 | 1.6.7+dfsg-1 |
roundcubeDebian:10 From an advisory covering 2 CVEs |
before 1.3.17+dfsg.1-1~deb10u6, plus listed versions 1.3.10+dfsg.1-11.3.10+dfsg.1-1~deb10u11.3.11+dfsg.1-1~deb10u11.3.13+dfsg.1-1~deb10u11.3.14+dfsg.1-1~deb10u1 Show 8 moreShow less1.3.15+dfsg.1-1~deb10u11.3.16+dfsg.1-1~deb10u11.3.17+dfsg.1-1~deb10u11.3.17+dfsg.1-1~deb10u21.3.17+dfsg.1-1~deb10u31.3.17+dfsg.1-1~deb10u41.3.17+dfsg.1-1~deb10u51.3.8+dfsg.1-2 |
1.3.17+dfsg.1-1~deb10u6 |
roundcubeDebian:11 From an advisory covering 2 CVEs |
before 1.4.15+dfsg.1-1+deb11u3, plus listed versions 1.4.11+dfsg.1-41.4.12+dfsg.1-1~bpo10+11.4.12+dfsg.1-1~deb11u11.4.13+dfsg.1-1~deb11u11.4.13+dfsg.1-1~deb11u1~bpo10+1 Show 6 moreShow less1.4.14+dfsg.1-1~deb11u11.4.14+dfsg.1-1~deb11u1~bpo10+11.4.15+dfsg.1-1~deb11u11.4.15+dfsg.1-1~deb11u1~bpo10+11.4.15+dfsg.1-1~deb11u21.4.15+dfsg.1-1~deb11u2~bpo10+1 |
1.4.15+dfsg.1-1+deb11u3 |
roundcubeDebian:12 From an advisory covering 2 CVEs |
before 1.6.5+dfsg-1+deb12u2, plus listed versions 1.6.1+dfsg-11.6.2+dfsg-11.6.3+dfsg-11.6.3+dfsg-1~deb12u11.6.3+dfsg-2 Show 4 moreShow less1.6.4+dfsg-11.6.4+dfsg-1~deb12u11.6.5+dfsg-11.6.5+dfsg-1~deb12u1 |
1.6.5+dfsg-1+deb12u2 |
roundcubeUbuntu:Pro:18.04:LTS |
before 1.3.6+dfsg.1-1ubuntu0.1~esm4, plus listed versions 1.3.0+dfsg.1-11.3.1+dfsg.1-11.3.3+dfsg.1-11.3.3+dfsg.1-21.3.6+dfsg.1-11.3.6+dfsg.1-1ubuntu0.1~esm11.3.6+dfsg.1-1ubuntu0.1~esm21.3.6+dfsg.1-1ubuntu0.1~esm3 |
1.3.6+dfsg.1-1ubuntu0.1~esm4 |
roundcubeUbuntu:Pro:20.04:LTS |
before 1.4.3+dfsg.1-1ubuntu0.1~esm4, plus listed versions 1.3.8+dfsg.1-21.3.10+dfsg.1-11.4.1+dfsg.1-21.4.2+dfsg.1-11.4.2+dfsg.1-2 Show 4 moreShow less1.4.3+dfsg.1-11.4.3+dfsg.1-1ubuntu0.1~esm11.4.3+dfsg.1-1ubuntu0.1~esm21.4.3+dfsg.1-1ubuntu0.1~esm3 |
1.4.3+dfsg.1-1ubuntu0.1~esm4 |
roundcubeUbuntu:Pro:22.04:LTS |
before 1.5.0+dfsg.1-2ubuntu0.1~esm3, plus listed versions 1.4.11+dfsg.1-41.5.0+dfsg.1-21.5.0+dfsg.1-2ubuntu0.1~esm11.5.0+dfsg.1-2ubuntu0.1~esm2 |
1.5.0+dfsg.1-2ubuntu0.1~esm3 |
roundcubeUbuntu:Pro:16.04:LTS From an advisory covering 4 CVEs |
before 1.2~beta+dfsg.1-0ubuntu1+esm4, plus listed versions 1.1.1+dfsg.1-21.1.2+dfsg.1-51.1.3+dfsg.1-11.1.4+dfsg.1-11.2~beta+dfsg.1-0ubuntu11.2~beta+dfsg.1-0ubuntu1+esm11.2~beta+dfsg.1-0ubuntu1+esm21.2~beta+dfsg.1-0ubuntu1+esm3 |
1.2~beta+dfsg.1-0ubuntu1+esm4 |
roundcubeUbuntu:Pro:18.04:LTS From an advisory covering 4 CVEs |
before 1.3.6+dfsg.1-1ubuntu0.1~esm4, plus listed versions 1.3.0+dfsg.1-11.3.1+dfsg.1-11.3.3+dfsg.1-11.3.3+dfsg.1-21.3.6+dfsg.1-11.3.6+dfsg.1-1ubuntu0.1~esm11.3.6+dfsg.1-1ubuntu0.1~esm21.3.6+dfsg.1-1ubuntu0.1~esm3 |
1.3.6+dfsg.1-1ubuntu0.1~esm4 |
roundcubeUbuntu:Pro:20.04:LTS From an advisory covering 4 CVEs |
before 1.4.3+dfsg.1-1ubuntu0.1~esm4, plus listed versions 1.3.8+dfsg.1-21.3.10+dfsg.1-11.4.1+dfsg.1-21.4.2+dfsg.1-11.4.2+dfsg.1-2 Show 4 moreShow less1.4.3+dfsg.1-11.4.3+dfsg.1-1ubuntu0.1~esm11.4.3+dfsg.1-1ubuntu0.1~esm21.4.3+dfsg.1-1ubuntu0.1~esm3 |
1.4.3+dfsg.1-1ubuntu0.1~esm4 |
roundcubeUbuntu:Pro:22.04:LTS From an advisory covering 4 CVEs |
before 1.5.0+dfsg.1-2ubuntu0.1~esm3, plus listed versions 1.4.11+dfsg.1-41.5.0+dfsg.1-21.5.0+dfsg.1-2ubuntu0.1~esm11.5.0+dfsg.1-2ubuntu0.1~esm2 |
1.5.0+dfsg.1-2ubuntu0.1~esm3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | bartfroklage/CVE-2024-37383-POC | 2024-10-24 |
| PoC in GitHub | amirzargham/CVE-2024-37383-exploit | 2024-11-03 |
| Exploit-DB | Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS) | 2025-04-11 |
| PoC in GitHub | hyungin0505/CVE-2024-37383_PoC | 2026-02-14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-37383 is a medium vulnerability (CVSS 6.1) in Roundcube Webmail, published June 7, 2024. CISA lists it as known to be exploited, since October 24, 2024. EUVD reports exploitation since October 24, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 74.0%, the 99th percentile. Fixed in roundcube 1.6.5+dfsg-1+deb12u2.
References
github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242
lists.debian.org/debian-lts-announce/2024/06/msg00008.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-37383
nvd.nist.gov/vuln/detail/CVE-2024-37383
Show 12 moreShow less
security-tracker.debian.org/tracker/CVE-2024-37383
ubuntu.com/security/CVE-2024-37383
cve.org/CVERecord?id=CVE-2024-37383
launchpad.net/bugs/2043396