{"affected":[{"product":"n/a","source":"CNA: mitre","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]},{"defaultStatus":"unknown","product":"roundcube_webmail","source":"ADP: CISA-ADP","vendor":"roundcube","versions":[{"lessThan":"1.5.7","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"roundcube_webmail","source":"ADP: CISA-ADP","vendor":"roundcube","versions":[{"lessThan":"1.6.7","status":"affected","version":"1.6.0","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*","versionEndExcluding":"1.5.7","vulnerable":true},{"criteria":"cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*","versionEndExcluding":"1.6.7","versionStartIncluding":"1.6.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveId":"CVE-2024-37385","cwes":["CWE-77"],"description":"Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.","epss":{"date":"2026-11-03","percentile":0.7391,"score":0.01477},"exploits":[],"kev":null,"metrics":[{"score":9.8,"severity":"critical","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":9.8,"severity":"critical","source":"NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793744240950,"publishedAt":1717730663567,"references":[{"source":"CNA: mitre","tags":[],"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"},{"source":"CNA: mitre","tags":[],"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"},{"source":"CNA: mitre","tags":[],"url":"https://github.com/roundcube/roundcubemail/commit/5ea9f37ce39374b6124586c0590fec7015d35d7f"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://github.com/roundcube/roundcubemail/commit/5ea9f37ce39374b6124586c0590fec7015d35d7f"},{"source":"cve@mitre.org","tags":["Patch"],"url":"https://github.com/roundcube/roundcubemail/commit/5ea9f37ce39374b6124586c0590fec7015d35d7f"},{"source":"cve@mitre.org","tags":["Release Notes"],"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"},{"source":"cve@mitre.org","tags":["Release Notes"],"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"url":"https://github.com/roundcube/roundcubemail/commit/5ea9f37ce39374b6124586c0590fec7015d35d7f"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes"],"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes"],"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"}],"remediation":[{"kind":"fix","source":"cve@mitre.org","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/roundcube/roundcubemail/commit/5ea9f37ce39374b6124586c0590fec7015d35d7f"},{"kind":"fix","source":"af854a3a-2127-422b-91ae-364da2661108","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/roundcube/roundcubemail/commit/5ea9f37ce39374b6124586c0590fec7015d35d7f"}],"revision":"fd266c4bf7b2994ddfc1538f7f29613f32891028e4c8954bcbdbf2006d04d6ec","sources":[{"modifiedAt":1793742757406,"name":"CNA: mitre","retrievedAt":1793743961550,"url":"https://www.cve.org/CVERecord?id=CVE-2024-37385"},{"modifiedAt":1793744240950,"name":"NVD","retrievedAt":1793751352596,"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37385"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793744005423,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-37385"}],"ssvc":{"assessedAt":1723780900370,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"CVE-2024-37385","updatedAt":1793751352596}