PT-2024-4656 · Unknown+4 · Roundcube Webmail+4

Huy Nguyễn Phạm Nhật · Published 2024-05-19 · Updated 2025-06-23 · CVE-2024-37384

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Roundcube Webmail versions 1.5.0 through 1.5.6 Roundcube Webmail versions 1.6.0 through 1.6.6

Description: The issue is related to insufficient protection of the web page structure in Roundcube Webmail, allowing a remote attacker to conduct cross-site scripting attacks using list columns from user preferences.

Recommendations: For Roundcube Webmail versions 1.5.0 through 1.5.6, update to version 1.5.7 or later. For Roundcube Webmail versions 1.6.0 through 1.6.6, update to version 1.6.7 or later. As a temporary workaround, consider restricting access to user preferences to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2025-8283

BDU:2024-05163

BDU:2024-05164

CVE-2024-37384

DLA-3835-1

DSA-5714-1

USN-6848-1

Affected Products

Alt Linux

Linuxmint

Red Os

Roundcube Webmail

Ubuntu

References · 35

• 🔥 https://github.com/bartfroklage/CVE-2024-37383-POC · Exploit
• 🔥❌ https://github.com/greandfather/EXPLOIT-Roundcube-vulnerability-POC-CVE-2023-5631- · Exploit, Deleted
• https://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7 · Patch
• https://security-tracker.debian.org/tracker/CVE-2024-37384 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-37383 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05163 · Security Note
• https://ubuntu.com/security/CVE-2023-5631 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37384 · Security Note
• https://ubuntu.com/security/CVE-2023-47272 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-37384 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6848-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-37383 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6848-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37384 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5714-1 · Vendor Advisory