‹ Retour à la liste

CVE-2024-37383

6.1 Moyenne Exploitée activement

Publiée le 07/06/2024 à 06:15 · Modifiée le 17/06/2026 à 09:38 · Analysée par le NVD · Source : cve@mitre.org

Catalogue CISA KEV — RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability

Ajoutée le 24/10/2024 · Échéance de correction (agences US) : 14/11/2024

Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.1 Moyenne	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
3.1	6.1 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242 Patch
https://github.com/roundcube/roundcubemail/releases/tag/1.5.7 Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.6.7 Release Notes
https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html Mailing ListThird Party Advisory
https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242 Patch
https://github.com/roundcube/roundcubemail/releases/tag/1.5.7 Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.6.7 Release Notes
https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html Mailing ListThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-37383 US Government Resource

Ailleurs