This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Roundcube Webmail fixes 3 vulnerabilities
Roundcube is fixing 3 vulnerabilities in Webmail in versions 1.5.7 and 1.6.7 [1][2]. The vulnerabilities are tracked only by Debian, and only those concerning XSS attacks, which it fixes for the trixie and sid releases in version 1.6.7+dfsg-1 [3]. Ubuntu does not yet track the vulnerabilities [4].
An unauthenticated remote attacker can carry out an XSS attack by sending a specially crafted e-mail [5][6][1][2].
The vulnerability is present in product:
- Roundcube; <1.5.7; >=1.6.0, <1.6.7;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
More information:
- CVE-2024-37384 at cve.org, NVD
- CVE-2024-37383 at cve.org, NVD
- CWE-79 at cwe.mitre.org
The vulnerability was publicly disclosed 7. 6. 2024.
An unauthenticated remote attacker can execute commands in the victim's operating system by sending a specially crafted e-mail [7][1][2].
The vulnerability is present in product:
- Roundcube; <1.5.7; >=1.6.0, <1.6.7;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-37385 at cve.org, NVD
- CWE-78 at cwe.mitre.org
The vulnerability was publicly disclosed 7. 6. 2024.
Links
- [1] https://github.com/roundcube/roundcubemail/releases/tag/1.5.7
- [2] https://github.com/roundcube/roundcubemail/releases/tag/1.6.7
- [3] https://security-tracker.debian.org/tracker/source-package/roundcube
- [4] https://ubuntu.com/security/cves?q=&package=roundcube
- [5] https://nvd.nist.gov/vuln/detail/CVE-2024-37384
- [6] https://nvd.nist.gov/vuln/detail/CVE-2024-37383
- [7] https://nvd.nist.gov/vuln/detail/CVE-2024-37385
By CESNET, z.s.p.o. Martin Krajči on 7. 6. 2024.