CISA KEV · Known exploitedMedium
CVE-2024-37383
Roundcube Webmail
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
- CVSS
- 6.1
- EPSS
- 73.3% 99.4% percentile
- CISA KEV
- Listed
- Published
- 2024.06.07
Immediate review
CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.
Known exploitationConfirmed by CISA KEV
Exploit probability73.3%
Technical severityCVSS 6.1
Vulnerability overview
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
Affected product and versions
- Product
- Roundcube Webmail
- Affected versions
- 1.6.0, < 1.5.7, >= 1.6.0 < 1.6.7, 10.0
- Fixed versions
- 1.5.7, 1.6.7
Recommended response sequence
Confirm exposure before applying a vendor-supported change.
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due date: 2024.11.14- 1Identify
Confirm that Roundcube Webmail and an affected version are present.
- 2Prioritize
Combine exploitation signals with asset exposure and business criticality.
- 3Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
- 4Verify
Recheck the version, service health, access paths, and relevant logs.
Technical data
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CWE
- CWE-79
- KEV added
- 2024.10.24
- Ransomware use
- 미확인