medium6.1
CVE-2024-37384
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.
Impact
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Roundcube | Webmail | before 1.5.7 from 1.6.0 before 1.6.7 |
| Debian | Debian Linux | Version 10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.7
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.7
- https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html
- https://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.7
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.7
- https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html