# CVE-2024-37383

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

- Page: https://www.vulneraibility.com/cve/CVE-2024-37383
- CVSS: 6.1
- Known exploited: yes, in CISA KEV since 2024-10-24; CISA due date 2024-11-14
- EPSS: 74.00%
- Public exploit code: 1 on Exploit-DB · 3 GitHub proofs of concept (first 2024-10-24)
- CISA SSVC: exploitation active, automatable no, technical impact partial (assessed 2024-10-25)
- Weakness: CWE-79
- Published: 2024-06-07

## Affected

- roundcube:webmail
- debian:debian_linux

## References

- [other] https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242
- [other] https://github.com/roundcube/roundcubemail/releases/tag/1.6.7
- [other] https://github.com/roundcube/roundcubemail/releases/tag/1.5.7
- [other] https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-37383

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.