VulnSocial

CVE-2024-37385General(microsoft / webmail)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.

microsoft CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Other references
Weakness type (CWE)
CWE-77

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • webmail
  • windows

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • General: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
microsoftroundcube
Products
webmailwindows

1 version affected across 2 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-03-12: 103-12
Signal classification1 categories
General
1100.0%
Full discourse1 post
  • Alone@alodotne
    General

    @the_real_egg_f @ProtonMail I'm confused? A webmail client is better than the actual email service it self?! CVE-2025-68461 CVE-2025-49113 CVE-2025-68460 CVE-2024-42009 CVE-2024-37385 CVE-2023-5631 CVE-2021-44026 CVE-2020-12641 CVE-2017-16651

    Post summary

    The tweet lists multiple CVE identifiers without providing any context, details, or actionable information.

    10000174
    54 followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
OSmicrosoftwindows---
Approundcubewebmail---

Explore more

Back to dashboardmicrosoft CVEsroundcube CVEswebmail vulnerabilities