{"id":"CVE-2024-37383","aliases":["DEBIAN-CVE-2024-37383","DLA-3835-1","DSA-5714-1","EUVD-2024-36625","GHSA-8j3w-26mp-75xh","UBUNTU-CVE-2024-37383","USN-6848-1"],"status":"published","title":"Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.","description":"Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.73995,"percentile":0.99487,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2024-06-07T00:00:00Z","modified":"2026-11-02T12:02:35Z","kev":{"date_added":"2024-10-24","due_date":"2024-11-14","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-10-24"},{"source":"kev","since":"2024-10-24"}],"exploits":[{"source":"pocgithub","id":"bartfroklage/CVE-2024-37383-POC","title":"bartfroklage/CVE-2024-37383-POC","date":"2024-10-24","url":"https://github.com/bartfroklage/CVE-2024-37383-POC"},{"source":"pocgithub","id":"amirzargham/CVE-2024-37383-exploit","title":"amirzargham/CVE-2024-37383-exploit","date":"2024-11-03","url":"https://github.com/amirzargham/CVE-2024-37383-exploit"},{"source":"exploitdb","id":"EDB-52173","title":"Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS)","type":"webapps","platform":"php","date":"2025-04-11","url":"https://www.exploit-db.com/exploits/52173"},{"source":"pocgithub","id":"hyungin0505/CVE-2024-37383_PoC","title":"hyungin0505/CVE-2024-37383_PoC","date":"2026-02-14","url":"https://github.com/hyungin0505/CVE-2024-37383_PoC"}],"fixes":[{"ecosystem":"Debian:12","package":"roundcube","fixed_in":["1.6.5+dfsg-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"roundcube","fixed_in":["1.6.7+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"roundcube","fixed_in":["1.6.7+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","fixed_in":["1.3.6+dfsg.1-1ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","fixed_in":["1.4.3+dfsg.1-1ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","fixed_in":["1.5.0+dfsg.1-2ubuntu0.1~esm3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u2"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1","1.6.5+dfsg-1","1.6.5+dfsg-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.17+dfsg.1-1~deb10u6"}]}],"versions":["1.3.10+dfsg.1-1","1.3.10+dfsg.1-1~deb10u1","1.3.11+dfsg.1-1~deb10u1","1.3.13+dfsg.1-1~deb10u1","1.3.14+dfsg.1-1~deb10u1","1.3.15+dfsg.1-1~deb10u1","1.3.16+dfsg.1-1~deb10u1","1.3.17+dfsg.1-1~deb10u1","1.3.17+dfsg.1-1~deb10u2","1.3.17+dfsg.1-1~deb10u3","1.3.17+dfsg.1-1~deb10u4","1.3.17+dfsg.1-1~deb10u5","1.3.8+dfsg.1-2"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15+dfsg.1-1+deb11u3"}]}],"versions":["1.4.11+dfsg.1-4","1.4.12+dfsg.1-1~bpo10+1","1.4.12+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1~bpo10+1","1.4.14+dfsg.1-1~deb11u1","1.4.14+dfsg.1-1~deb11u1~bpo10+1","1.4.15+dfsg.1-1~deb11u1","1.4.15+dfsg.1-1~deb11u1~bpo10+1","1.4.15+dfsg.1-1~deb11u2","1.4.15+dfsg.1-1~deb11u2~bpo10+1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u2"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1","1.6.5+dfsg-1","1.6.5+dfsg-1~deb12u1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6+dfsg.1-1ubuntu0.1~esm4"}]}],"versions":["1.3.0+dfsg.1-1","1.3.1+dfsg.1-1","1.3.3+dfsg.1-1","1.3.3+dfsg.1-2","1.3.6+dfsg.1-1","1.3.6+dfsg.1-1ubuntu0.1~esm1","1.3.6+dfsg.1-1ubuntu0.1~esm2","1.3.6+dfsg.1-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg.1-1ubuntu0.1~esm4"}]}],"versions":["1.3.8+dfsg.1-2","1.3.10+dfsg.1-1","1.4.1+dfsg.1-2","1.4.2+dfsg.1-1","1.4.2+dfsg.1-2","1.4.3+dfsg.1-1","1.4.3+dfsg.1-1ubuntu0.1~esm1","1.4.3+dfsg.1-1ubuntu0.1~esm2","1.4.3+dfsg.1-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0+dfsg.1-2ubuntu0.1~esm3"}]}],"versions":["1.4.11+dfsg.1-4","1.5.0+dfsg.1-2","1.5.0+dfsg.1-2ubuntu0.1~esm1","1.5.0+dfsg.1-2ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2~beta+dfsg.1-0ubuntu1+esm4"}]}],"versions":["1.1.1+dfsg.1-2","1.1.2+dfsg.1-5","1.1.3+dfsg.1-1","1.1.4+dfsg.1-1","1.2~beta+dfsg.1-0ubuntu1","1.2~beta+dfsg.1-0ubuntu1+esm1","1.2~beta+dfsg.1-0ubuntu1+esm2","1.2~beta+dfsg.1-0ubuntu1+esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6+dfsg.1-1ubuntu0.1~esm4"}]}],"versions":["1.3.0+dfsg.1-1","1.3.1+dfsg.1-1","1.3.3+dfsg.1-1","1.3.3+dfsg.1-2","1.3.6+dfsg.1-1","1.3.6+dfsg.1-1ubuntu0.1~esm1","1.3.6+dfsg.1-1ubuntu0.1~esm2","1.3.6+dfsg.1-1ubuntu0.1~esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg.1-1ubuntu0.1~esm4"}]}],"versions":["1.3.8+dfsg.1-2","1.3.10+dfsg.1-1","1.4.1+dfsg.1-2","1.4.2+dfsg.1-1","1.4.2+dfsg.1-2","1.4.3+dfsg.1-1","1.4.3+dfsg.1-1ubuntu0.1~esm1","1.4.3+dfsg.1-1ubuntu0.1~esm2","1.4.3+dfsg.1-1ubuntu0.1~esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0+dfsg.1-2ubuntu0.1~esm3"}]}],"versions":["1.4.11+dfsg.1-4","1.5.0+dfsg.1-2","1.5.0+dfsg.1-2ubuntu0.1~esm1","1.5.0+dfsg.1-2ubuntu0.1~esm2"],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"roundcube","product":"webmail"}],"references":[{"url":"https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242","tags":["x_transferred","Patch","fix","report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.7","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.7","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-37383","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37383","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8j3w-26mp-75xh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37383.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-37383","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-37383","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-37383","tags":["report"]},{"url":"https://github.com/roundcube/roundcubemail/commit/ba252dc5e2946506cb8d0b50b2b7bf95ab51876f","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6848-1","tags":["advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-5631","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-47272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-37384","tags":["report"]},{"url":"https://launchpad.net/bugs/2043396","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-37383","description":"Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.","status":"published","published":"2024-06-07T00:00:00Z","modified":"2025-10-21T23:05:16.615Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:00.585327Z"}],"euvd":[{"id":"EUVD-2024-36625","description":"Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.","status":"published","published":"2024-06-07T00:00:00Z","modified":"2025-10-21T23:05:16Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"exploited_since":"2024-10-24","updated_at":"2026-11-02T20:31:28.525814Z"}],"ghsa":[{"id":"GHSA-8j3w-26mp-75xh","title":"Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.","description":"Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.","status":"published","published":"2024-06-07T06:30:29Z","modified":"2025-10-22T00:34:06Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:04:08.734574Z"}],"kev":[{"id":"CVE-2024-37383","title":"RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability","description":"RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.","cwes":["CWE-79"],"kev":{"date_added":"2024-10-24","due_date":"2024-11-14","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2024-37383","description":"Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.","status":"published","published":"2024-06-07T04:15:30.463Z","modified":"2026-06-17T07:38:15.543Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:04.111836Z"}],"osv":[{"id":"CVE-2024-37383","description":"Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.","status":"published","published":"2024-06-07T00:00:00Z","modified":"2026-10-28T02:30:36.441671246Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:41.133403Z"},{"id":"DEBIAN-CVE-2024-37383","description":"Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.","status":"published","published":"2024-06-07T04:15:30.463Z","modified":"2026-11-02T12:02:35.635265534Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:42.835825Z"},{"id":"UBUNTU-CVE-2024-37383","description":"Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.","status":"published","published":"2024-06-07T04:15:00Z","modified":"2026-02-04T02:25:26.571269Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"DLA-3835-1","title":"roundcube - security update","status":"published","published":"2024-06-17T00:00:00Z","modified":"2026-03-09T01:21:29.970774Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5714-1","title":"roundcube - security update","status":"published","published":"2024-06-18T00:00:00Z","modified":"2026-03-09T02:10:59.098882Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"USN-6848-1","title":"roundcube vulnerabilities","description":"Matthieu Faou and Denys Klymenko discovered that Roundcube incorrectly\nhandled certain SVG images. A remote attacker could possibly use this\nissue to load arbitrary JavaScript code. This issue only affected Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10.\n(CVE-2023-5631)\n\nRene Rehme discovered that Roundcube incorrectly handled certain headers.\nA remote attacker could possibly use this issue to load arbitrary\nJavaScript code. This issue only affected Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-47272)\n\nValentin T. and Lutz Wolf discovered that Roundcube incorrectly handled\ncertain SVG images. A remote attacker could possibly use this issue to\nload arbitrary JavaScript code. This issue only affected Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2024-37383)\n\nHuy Nguyễn Phạm Nhật discovered that Roundcube incorrectly handled\ncertain fields in user preferences. A remote attacker could possibly use\nthis issue to load arbitrary JavaScript code. (CVE-2024-37384)\n","status":"published","published":"2024-06-25T18:16:54Z","modified":"2026-06-25T13:32:28.795533862Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}