PT-2024-4339 · Unknown · Roundcube Webmail

Lutz Wolf + 1 · CVE-2024-37385 · Published 2024-06-06 · Updated 2026-03-12

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions 1.5.0 through 1.5.6 Roundcube Webmail versions 1.6.0 through 1.6.6

Description The issue is related to an incomplete fix for a previous problem and allows command injection via im convert path and im identify path. This can potentially allow a remote attacker to elevate their privileges. The problem exists because of insufficient data cleaning at the management level.

Recommendations For Roundcube Webmail versions 1.5.0 through 1.5.6, update to version 1.5.7 or later. For Roundcube Webmail versions 1.6.0 through 1.6.6, update to version 1.6.7 or later. As a temporary workaround, consider restricting access to the im convert path and im identify path functions until a patch is available.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-04828

CVE-2024-37385

Affected Products

Roundcube Webmail

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37385.json · Exploit
• https://github.com/roundcube/roundcubemail/commit/5ea9f37ce39374b6124586c0590fec7015d35d7f · Patch
• https://osv.dev/vulnerability/CVE-2024-37385 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37385 · Security Note
• https://bdu.fstec.ru/vul/2024-04828 · Security Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.7 · Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.7 · Note
• https://t.me/cvenotify/120570 · Telegram Post
• https://twitter.com/alodotne/status/2032135031808762137 · Twitter Post
• https://t.me/cvenotify/82238 · Telegram Post
• https://twitter.com/CVEnew/status/1798920827192111358 · Twitter Post
• https://t.me/cveNotify/151160 · Telegram Post
• https://vuldb.com/ru/?id.267379 · Note
• https://twitter.com/VulmonFeeds/status/1798951803251499395 · Twitter Post