Roundcube Webmail < 1.5.7 and 1.6.x < 1.6.7 - Cross-Site Scripting via SVG Animate Attributes
Title source: llmExploitation Summary
CVE-2024-37383 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added October 24, 2024. EIP tracks 4 public exploits from researchers including AmirZargham, bartfroklage, hyungin0505.
AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in Roundcube Webmail versions earlier than 1.5.6 or from 1.6 to 1.6.6. It automates the retrieval of all inbox messages and forwards them to an attacker-controlled server via JavaScript injection.
Description
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
Exploits (4)
This exploit demonstrates a stored XSS vulnerability in Roundcube Webmail versions earlier than 1.5.6 or from 1.6 to 1.6.6. It automates the retrieval of all inbox messages and forwards them to an attacker-controlled server via JavaScript injection.
This repository contains a functional proof-of-concept exploit for CVE-2024-37383, an XSS vulnerability in Roundcube. The exploit sends a crafted email with an SVG-based payload that triggers an alert when clicked by the victim in Roundcube's web interface.
This repository contains a functional PoC for CVE-2024-37383, an XSS vulnerability in Roundcube Webmail due to improper SVG attribute parsing. It includes a Docker setup for a vulnerable environment and a Python script to send a malicious email with an SVG payload.
This repository contains a functional JavaScript-based exploit for CVE-2024-37383, a stored XSS vulnerability in Roundcube Webmail. The exploit automates the extraction of all messages from a victim's inbox and forwards them to an attacker-controlled server via crafted SVG payloads.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N