Search/CVE-2024-37383
● CVE — Medium

CVE-2024-37383

Vendordebian, roundcubeProductdebian linux, webmailDiscoveredJun 7, 2024UpdatedOct 31, 2025

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

View graph Watch Export
CVSS v3.1
6.1 MEDIUM
EPSS
74.0%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
1
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 26, 2026
▲ 0.70pp
73.3% → 74.0% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeCHANGED
ConfidentialityLOW
IntegrityLOW
AvailabilityNONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Connections
5 relationships
Timeline
disclosure → media coverage
Jun 7, 2024
Disclosure — published as a CVE record. · last revised by NVD Oct 31, 2025
Sep 25, 2026
securityweek.com reports: Roundcube Webmail Vulnerability in Attackers’ Crosshairs
Public PoC (3)
github.com/bartfroklage/CVE-2024-37383-POCgithub.com/amirzargham/CVE-2024-37383-exploitgithub.com/hyungin0505/CVE-2024-37383_PoC
Unverified third-party code — review before executing.