CVE-2024-37384: XSS

Q: What is the severity of CVE-2024-37384?

CVE-2024-37384 is classified as a moderate severity vulnerability affecting Roundcube Webmail.

Q: How do I fix CVE-2024-37384?

To fix CVE-2024-37384, upgrade to Roundcube Webmail versions 1.5.7 or 1.6.7 or later.

Q: What type of vulnerability is CVE-2024-37384?

CVE-2024-37384 is an XSS (Cross-Site Scripting) vulnerability related to user preference list columns.

Q: Which versions of Roundcube Webmail are affected by CVE-2024-37384?

Roundcube Webmail versions prior to 1.5.7 and the 1.6.x series before 1.6.7 are affected by CVE-2024-37384.

Q: Is it safe to use Roundcube Webmail versions before 1.5.7 or 1.6.7 given CVE-2024-37384?

Using versions of Roundcube Webmail before 1.5.7 or 1.6.7 is not recommended due to the risk associated with CVE-2024-37384.

Published Jun 7, 2024

Updated

Last updated 24 July 2024

Other sources

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.

— Launchpad

Affected Software

7 affected componentsFixes available

Roundcube Webmail<1.5.7

Roundcube Webmail>=1.6.0<1.6.7

Debian Debian Linux=10.0

debian/roundcube<1.6.5+dfsg-1+deb12u2

1.6.5+dfsg-1+deb12u2

debian/roundcube<1.6.7+dfsg-1

1.6.7+dfsg-1

debian/roundcube<1.6.7+dfsg-1

1.6.7+dfsg-1

debian/roundcube

1.6.5+dfsg-1+deb12u91.6.5+dfsg-1+deb12u121.6.18+dfsg-0+deb13u11.6.20+dfsg-0+deb13u11.6.20+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/roundcube to a version that resolves this vulnerability.
Fixed in 1.6.5+dfsg-1+deb12u2
Upgrade
Upgrade debian/roundcube to a version that resolves this vulnerability.
Fixed in 1.6.7+dfsg-1
Upgrade
Upgrade debian/roundcube to a version that resolves this vulnerability.
Fixed in 1.6.5+dfsg-1+deb12u9Fixed in 1.6.5+dfsg-1+deb12u12Fixed in 1.6.18+dfsg-0+deb13u1Fixed in 1.6.20+dfsg-0+deb13u1Fixed in 1.6.20+dfsg-1
Upgrade
Upgrade Roundcube Webmail to a version that resolves this vulnerability.
Fixed in 1.5.7
Upgrade
Upgrade Roundcube Webmail to a version that resolves this vulnerability.
Fixed in 1.6.7

Event History

Jun 7, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·04:15 AM

DescriptionWeakness

Data Sourced

via OSV·04:15 AM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-5714

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3835-1

Frequently Asked Questions

What is the severity of CVE-2024-37384?

CVE-2024-37384 is classified as a moderate severity vulnerability affecting Roundcube Webmail.

How do I fix CVE-2024-37384?

To fix CVE-2024-37384, upgrade to Roundcube Webmail versions 1.5.7 or 1.6.7 or later.

What type of vulnerability is CVE-2024-37384?

CVE-2024-37384 is an XSS (Cross-Site Scripting) vulnerability related to user preference list columns.

Which versions of Roundcube Webmail are affected by CVE-2024-37384?

Roundcube Webmail versions prior to 1.5.7 and the 1.6.x series before 1.6.7 are affected by CVE-2024-37384.

Is it safe to use Roundcube Webmail versions before 1.5.7 or 1.6.7 given CVE-2024-37384?

Using versions of Roundcube Webmail before 1.5.7 or 1.6.7 is not recommended due to the risk associated with CVE-2024-37384.

CVE-2024-37384: XSS

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-37384?

How do I fix CVE-2024-37384?

What type of vulnerability is CVE-2024-37384?

Which versions of Roundcube Webmail are affected by CVE-2024-37384?

Is it safe to use Roundcube Webmail versions before 1.5.7 or 1.6.7 given CVE-2024-37384?

Company

Resources

Contact