CVE-2024-37384: XSS
Published Jun 7, 2024
·Updated
Last updated 24 July 2024
Other sources
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.
— Launchpad
Affected Software
4 affected componentsFixes available
debian/roundcube
1.4.15+dfsg.1-1+deb11u41.6.5+dfsg-1+deb12u41.6.9+dfsg-1
Roundcube Webmail<1.5.7
Roundcube Webmail>=1.6.0<1.6.7
Debian Debian Linux=10.0
Remediation
Event History
Jun 7, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:15 AM
DescriptionWeakness
Data Sourced
via NVD·04:15 AM
Severity
Jun 30, 2024
Data Sourced
via Launchpad·09:47 AM
Description
Sep 14, 2024
Data Sourced
via Ubuntu·10:00 AM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-37384?
CVE-2024-37384 is classified as a moderate severity vulnerability affecting Roundcube Webmail.
2
How do I fix CVE-2024-37384?
To fix CVE-2024-37384, upgrade to Roundcube Webmail versions 1.5.7 or 1.6.7 or later.
3
What type of vulnerability is CVE-2024-37384?
CVE-2024-37384 is an XSS (Cross-Site Scripting) vulnerability related to user preference list columns.
4
Which versions of Roundcube Webmail are affected by CVE-2024-37384?
Roundcube Webmail versions prior to 1.5.7 and the 1.6.x series before 1.6.7 are affected by CVE-2024-37384.
5
Is it safe to use Roundcube Webmail versions before 1.5.7 or 1.6.7 given CVE-2024-37384?
Using versions of Roundcube Webmail before 1.5.7 or 1.6.7 is not recommended due to the risk associated with CVE-2024-37384.