cyfenced.com →

[ CVE-2024-37383 · Published 7 Jun 2024 ]

RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability

Exploited · CISA KEV CVSS 6.1 EPSS 73%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2024-10-24
  • EPSS: 73% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

CISA: RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 14 Nov 2024): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

[ References ]References