Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6848-1 advisory.

    Matthieu Faou and Denys Klymenko discovered that Roundcube incorrectly handled certain SVG images. A     remote attacker could possibly use this issue to load arbitrary JavaScript code. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-5631)

    Rene Rehme discovered that Roundcube incorrectly handled certain headers. A remote attacker could possibly     use this issue to load arbitrary JavaScript code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04     LTS and Ubuntu 23.10. (CVE-2023-47272)

    Valentin T. and Lutz Wolf discovered that Roundcube incorrectly handled certain SVG images. A remote     attacker could possibly use this issue to load arbitrary JavaScript code. This issue only affected Ubuntu     18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2024-37383)

    Huy Nguyn Phm Nht discovered that Roundcube incorrectly handled certain fields in user     preferences. A remote attacker could possibly use this issue to load arbitrary JavaScript code.
    (CVE-2024-37384)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5714 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5714-1                   security@debian.org     https://www.debian.org/security/                       Sebastien Delafond     June 18, 2024                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : roundcube     CVE ID         : CVE-2024-37383 CVE-2024-37384     Debian Bug     : 1071474

    Huy Nguyn Phm Nht, and Valentin T. and Lutz Wolf of CrowdStrike,     discovered that roundcube, a skinnable AJAX based webmail solution for     IMAP servers, did not correctly process and sanitize requests. This     would allow an attacker to perform Cross-Side Scripting (XSS) attacks.

    For the oldstable distribution (bullseye), these problems have been fixed     in version 1.4.15+dfsg.1-1+deb11u3.

    For the stable distribution (bookworm), these problems have been fixed in     version 1.6.5+dfsg-1+deb12u2.

    We recommend that you upgrade your roundcube packages.

    For the detailed security status of roundcube please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/roundcube

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3835 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3835-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     June 17, 2024                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : roundcube     Version        : 1.3.17+dfsg.1-1~deb10u6     CVE ID         : CVE-2024-37383 CVE-2024-37384     Debian Bug     : 1071474

    Cross-site scripting (XSS) vulnerabilities were discovered in Roundcube,     a skinnable AJAX based webmail solution for IMAP servers, which could     allow a remote attacker to load arbitrary JavaScript code and might lead     to privilege escalation or information disclosure.

    CVE-2024-37383

        Valentin T. and Lutz Wolf of CrowdStrike discovered that Roundcube         allows XSS via SVG animate attributes.

    CVE-2024-37384

        Huy Nguyn Phm Nht discovered that Roundcube allows XSS via list         columns from user preferences.

    For Debian 10 buster, these problems have been fixed in version     1.3.17+dfsg.1-1~deb10u6.

    We recommend that you upgrade your roundcube packages.

    For the detailed security status of roundcube please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/roundcube

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
201016	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : Roundcube vulnerabilities (USN-6848-1)	Nessus	Ubuntu Local Security Checks	medium
200701	Debian dsa-5714 : roundcube - security update	Nessus	Debian Local Security Checks	medium
200652	Debian dla-3835 : roundcube - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2024-37383

medium

Tenable Plugins

medium

medium

medium