CVE-2024-37383

Description

RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.

References

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://nvd.nist.gov/vuln/detail/CVE-2024-37383
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.7
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.7
• https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-36625
• https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242
• https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html