OpenCVE

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Roundcube	Roundcube Webmail

No data.

No data.

References

Link	Providers
https://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7
https://github.com/roundcube/roundcubemail/releases/tag/1.5.7
https://github.com/roundcube/roundcubemail/releases/tag/1.6.7
https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html

History

Mon, 04 Nov 2024 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-06-07T00:00:00

Updated: 2024-11-04T16:24:03.779Z

Reserved: 2024-06-07T00:00:00

Link: CVE-2024-37384

Vulnrichment

Updated: 2024-08-02T03:50:56.175Z

NVD

Status : Awaiting Analysis

Published: 2024-06-07T04:15:30.597

Modified: 2024-11-21T09:23:44.963

Link: CVE-2024-37384

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-37384", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-11-04T16:24:03.779Z", "dateReserved": "2024-06-07T00:00:00", "datePublished": "2024-06-07T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-17T15:06:04.942031"}, "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"}, {"url": "https://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7"}, {"name": "[debian-lts-announce] 20240617 [SECURITY] [DLA 3835-1] roundcube security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "affected": [{"vendor": "roundcube", "product": "roundcube_webmail", "cpes": ["cpe:2.3:a:roundcube:roundcube_webmail:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.5.7", "versionType": "custom"}, {"version": "1.6.x", "status": "affected", "lessThan": "1.6.7", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-06-17T17:48:19.770411Z", "id": "CVE-2024-37384", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-04T16:24:03.779Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:50:56.175Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.7", "tags": ["x_transferred"]}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.7", "tags": ["x_transferred"]}, {"url": "https://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7", "tags": ["x_transferred"]}, {"name": "[debian-lts-announce] 20240617 [SECURITY] [DLA 3835-1] roundcube security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html"}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.7", "tags": ["x_transferred"]}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.7", "tags": ["x_transferred"]}, {"url": "https://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html", "name": "[debian-lts-announce] 20240617 [SECURITY] [DLA 3835-1] roundcube security update", "tags": ["mailing-list", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:50:56.175Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-37384", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-17T17:48:19.770411Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:roundcube:roundcube_webmail:*:*:*:*:*:*:*:*"], "vendor": "roundcube", "product": "roundcube_webmail", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.7", "versionType": "custom"}, {"status": "affected", "version": "1.6.x", "lessThan": "1.6.7", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T17:47:50.561Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"}, {"url": "https://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html", "name": "[debian-lts-announce] 20240617 [SECURITY] [DLA 3835-1] roundcube security update", "tags": ["mailing-list"]}], "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-17T15:06:04.942031"}}}, "cveMetadata": {"cveId": "CVE-2024-37384", "state": "PUBLISHED", "dateUpdated": "2024-11-04T16:24:03.779Z", "dateReserved": "2024-06-07T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-06-07T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}