OS Command Injection in Roundcube Webmail - CVE-2024-37385
Published: May 21, 2024 / Updated: June 26, 2024
Vulnerability identifier: #VU89683
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-37385
CWE-ID: CWE-78
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation when handling values for the "im_convert_path" and "im_identify_path" options on Windows. A local user with ability to edit the configuration file can execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Roundcube Webmail
Fedora
roundcubemail
Fedora
roundcubemail
How to mitigate CVE-2024-37385
Install updates from vendor's website.
Roundcube Webmail - addressed in versions 1.5.7, 1.6.7
roundcubemail - addressed in versions 1.5.7-1.el9, 1.6.7-1.fc39, 1.6.7-1.fc40
roundcubemail - addressed in versions 1.5.7-1.el9, 1.6.7-1.fc39, 1.6.7-1.fc40