CVE-2024-37385 — Vulnerability intelligence

roundcube — webmail

Published: 2024-06-07T03:24:23.567Z

CVSS

9.8

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.

Sources

• CVE-2024-37385
• Patch
• Release Notes
• Release Notes
• CVE-2024-37385