CVE-2024-37383: Roundcube Webmail cross-site scripting, exploited in government phishing
The short version: Roundcube Webmail has a cross-site scripting flaw (CVE-2024-37383) that abuses SVG animate attributes in an email to run attacker script in the mailbox of whoever opens it. It's in CISA's KEV catalog, and it was used in real phishing campaigns against government agencies to steal credentials. The fix is a simple upgrade. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — see below |
| CVSS v3.1 (NVD) | 6.1 — Medium · AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| EPSS | 73.30% · 99.40th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2024-11-14 |
| Known exploited? | Yes — used in phishing against government targets |
| Vulnerability type | CWE-79 cross-site scripting (via SVG animate attributes) → session/credential theft |
| Requires authenticated session? | No for the attacker — a logged-in victim must open the crafted message (UI:R) |
| Affected | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 |
| Fixed in | 1.5.7 · 1.6.7 |
What you need to know
The flaw is in how Roundcube processes SVG content in messages: animate attributes let attacker JavaScript survive sanitization and execute when the email is viewed. Public reporting tied it to phishing that injected fake login forms into the Roundcube interface to capture credentials.
- Delivery is just email. No access to your environment is needed to put the payload in front of a user.
- It runs in a trusted place. Script executing inside webmail can read the mailbox and forge a login prompt that looks native.
- It was operational, not theoretical. Researchers documented in-the-wild use against government mail servers — which is what moved it into KEV.
How serious we see it
Moderate — with the same honest note as the other webmail XSS bugs.
The 6.1 reflects user-interaction XSS with limited direct impact. The reason it matters more than the number suggests is the demonstrated conversion into credential theft and account takeover, against real targets. Still, it's bounded and fixable: two version lines, a published patch, quick to verify. Upgrading closes it cleanly.
Recommendations
Straight from Roundcube's release and CISA:
- Patch now. Upgrade to 1.6.7 or 1.5.7 (or later).
- Enforce MFA on webmail. It reduces the value of a stolen password.
- Restrict exposure. Keep the Roundcube host reachable only where it must be.
- Warn users about in-app re-login prompts. A sudden password prompt inside webmail is a red flag worth reporting.
- Confirm your exposure first. Verify whether an internet-facing Roundcube instance exists and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing Roundcube from little more than your domain, fingerprints the version, and flags exposure tied to KEV-listed vulnerabilities like this one, ranked up because it's actively exploited. We identify and flag the affected version; we don't deliver the payload. The outside-in view keeps an exposed, unpatched Roundcube on your map before someone else's email finds it.