CVE-2024-37384

MEDIUM

Roundcube Webmail < 1.5.7 - XSS

Title source: rule

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.

Core 4

Core References

Patch

Release Notes

Release Notes

Mailing List mailing-list

CVSS v3 6.1

EPSS 0.0053

EPSS Percentile 67.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

CWE

CWE-79

Status published

Products (2)

debian/debian_linux 10.0

roundcube/webmail < 1.5.7

Published Jun 07, 2024

Tracked Since Feb 18, 2026