Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.

According to its self-reported version number, Roundcube Webmail is prior to 1.5.7 or 1.6.x prior to 1.6.7. Therefore, it may be affected by multiple vulnerabilities :

 - A Cross-Site Scripting (XSS) via SVG animate attributes.

 - A Cross-Site Scripting (XSS) via list columns from user preferences.

 - A Command Injection via im_convert_path and im_identify_path.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114557	Roundcube Webmail 1.6.x < 1.6.7 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114556	Roundcube Webmail 1.5.x < 1.5.7 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2024-37385

critical

Tenable Plugins

critical

critical