CRITICAL
CVE-2024-42009
CVSS
9.3
KEV
Description
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
Summary dbcve.org
Cross-site scripting vulnerability in Roundcube's message_body() function allows remote attackers to inject malicious scripts via crafted email messages. This XSS can be exploited to steal victim emails and potentially send emails on their behalf due to improper sanitization of email content.
Mitigation
Update Roundcube to version 1.5.8 or 1.6.8 or later to patch the desanitization vulnerability in program/actions/mail/show.php.
Weakness (CWE)
CWE-79
Cross-site Scripting (XSS)
EPSS Score
82.88%
Probability of exploitation in next 30 days
99.7th percentile
References
https://github.com/roundcube/roundcubemail/releases
Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.5.8
Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.6.8
Release Notes
https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8
Vendor Advisory
https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/
Technical Description, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-42009
US Government Resource
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.