CVE-2024-42009

🗓️ 05 Aug 2024 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 351 Views🌐 WEB

A Cross-Site Scripting vulnerability in Roundcube allows remote attacker to steal and send emails via a crafted e-mail messag

Reporter	Title	Published	Views	Family All 67
GithubExploit	Exploit for Cross-site Scripting in Roundcube Webmail	11 Feb 202523:02	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Roundcube Webmail	24 May 202519:15	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Roundcube Webmail	17 Jun 202620:58	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Roundcube Webmail	13 Feb 202520:53	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Roundcube Webmail	16 Apr 202614:03	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Roundcube Webmail	26 May 202500:31	–	githubexploit
FreeBSD	Roundcube -- Multiple vulnerabilities	4 Aug 202400:00	–	freebsd
ATTACKERKB	CVE-2024-42009	5 Aug 202400:00	–	attackerkb
BDU FSTEC	The vulnerability of the message_body() function in the program/actions/mail/show.php file of the RoundCube Webmail email client allows a hacker to gain full access to the user’s email by sending a specially crafted message.	12 Aug 202400:00	–	bdu_fstec
Circl	CVE-2024-42009	5 Aug 202422:16	–	circl

NVD

Node

roundcube webmailRange1.6.0–1.6.8

Source	Link
github	www.github.com/roundcube/roundcubemail/releases/tag/1.5.8
github	www.github.com/roundcube/roundcubemail/releases
github	www.github.com/roundcube/roundcubemail/releases/tag/1.6.8
roundcube	www.roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8
sonarsource	www.sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
to	request body	contact	Stored XSS via crafted email payload delivered through the contact form, exploiting desanitization in Roundcube when rendering the message	CWE-79
subject	request body	contact	Stored XSS via crafted email payload delivered through the contact form, exploiting desanitization in Roundcube when rendering the message	CWE-79
body	request body	contact	Stored XSS via crafted email payload delivered through the contact form, exploiting desanitization in Roundcube when rendering the message	CWE-79
message_body	nested	program/actions/mail/show.php	XSS in Roundcube when processing the email body in show.php (desanitization issue in message_body()), enabling script execution via crafted message content	CWE-79

17 Jun 2026 07:48Current

6Medium risk

Vulners AI Score6

CVSS 3.19.3

EPSS0.84446

SSVC