Vulnerability Description
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Roundcube | Webmail | < 1.5.7 |
| Microsoft | Windows | - |
Related Weaknesses (CWE)
References
- https://github.com/roundcube/roundcubemail/commit/5ea9f37ce39374b6124586c0590fecPatch
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.7Release Notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.7Release Notes
- https://github.com/roundcube/roundcubemail/commit/5ea9f37ce39374b6124586c0590fecPatch
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.7Release Notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.7Release Notes
FAQ
What is CVE-2024-37385?
CVE-2024-37385 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12...
How severe is CVE-2024-37385?
CVE-2024-37385 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2024-37385?
Check the references section above for vendor advisories and patch information. Affected products include: Roundcube Webmail, Microsoft Windows.