CVE-2024-37383

RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability

Exploited in attacks Medium 6.1 Attack chance: 74%

What it is

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

CISA: RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: November 14, 2024

Added to the CISA list: October 24, 2024
Published: June 7, 2024
Severity: Medium 6.1 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 74% in the top 0.5% of all known vulnerabilities
Weakness: CWE-79
More details: NVD · CVE.org · CISA

All references (4)

More exploited flaws from Roundcube

Added	Vulnerability	Product	Severity	Attack chance
Feb 20, 2026	Deserialization of Untrusted DataCVE-2025-49113	Webmail	Critical 9.9	99.7%
Feb 20, 2026	Cross-site ScriptingCVE-2025-68461	Webmail	High 7.2	27%
Jun 9, 2025	Cross-Site ScriptingCVE-2024-42009	Webmail	Critical 9.3	83%
Jun 26, 2024	Cross-Site Scripting (XSS)CVE-2020-13965	Webmail	Medium 6.3	77%
Feb 12, 2024	Persistent Cross-Site Scripting (XSS)CVE-2023-43770	Webmail	Medium 6.1	64%
Oct 26, 2023	Persistent Cross-Site Scripting (XSS)CVE-2023-5631	Webmail	Medium 6.1	76%
Jun 22, 2023	Webmail Remote Code ExecutionCVE-2020-12641	Roundcube Webmail	Critical 9.8	84%
Jun 22, 2023	Webmail Cross-Site Scripting (XSS)CVE-2020-35730	Roundcube Webmail	Medium 6.1	33%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.