CVE-2024-37383 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Assigner	mitre
Reserved	2024-06-07
Published	2024-06-07
Updated	2024-10-24

Description

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

CISA Known Exploited Vulnerability

Date added: 2024-10-24
Due date: 2024-11-14

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

References

https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242

https://github.com/roundcube/roundcubemail/releases/tag/1.6.7

https://github.com/roundcube/roundcubemail/releases/tag/1.5.7

https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html ([debian-lts-announce] 20240617 [SECURITY] [DLA 3835-1] roundcube security update) mailing-list

cve.org CVE-2024-37383

nvd.nist.gov CVE-2024-37383

Download JSON

https://cve.threatint.com

Subscribe to our newsletter to learn more about our work.