CVE-2024-42009

🗓️ 05 Aug 2024 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 396 Views🌐 WEB

A Cross-Site Scripting vulnerability in Roundcube allows remote attacker to steal and send emails via a crafted e-mail messag

Reporter	Title	Published	Views	Family All 73
GithubExploit	Exploit for Cross-site Scripting in Roundcube Webmail	11 Feb 202523:02	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Roundcube Webmail	24 May 202519:15	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Roundcube Webmail	17 Jun 202620:58	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Roundcube Webmail	13 Feb 202520:53	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Roundcube Webmail	16 Apr 202614:03	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Roundcube Webmail	26 May 202500:31	–	githubexploit
FreeBSD	Roundcube -- Multiple vulnerabilities	4 Aug 202400:00	–	freebsd
ATTACKERKB	CVE-2024-42009	5 Aug 202400:00	–	attackerkb
BDU FSTEC	The vulnerability of the message_body() function in the program/actions/mail/show.php file of the RoundCube Webmail email client allows a hacker to gain full access to the user’s email by sending a specially crafted message.	12 Aug 202400:00	–	bdu_fstec
Circl	CVE-2024-42009	5 Aug 202422:16	–	circl

NVD

Node

roundcube webmailRange1.6.0–1.6.8

Source	Link
github	www.github.com/roundcube/roundcubemail/releases/tag/1.5.8
github	www.github.com/roundcube/roundcubemail/releases
github	www.github.com/roundcube/roundcubemail/releases/tag/1.6.8
roundcube	www.roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8
sonarsource	www.sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
recipient	request body	/contact	Stored XSS via a crafted email sent through the contact form to trigger desanitization and enable payload execution/exfiltration.	CWE-79
payload	request body	/contact	Stored XSS via a crafted email sent through the contact form to trigger desanitization and enable payload execution/exfiltration.	CWE-79
_task	query param	/?_task=mail&_action=list	Roundcube internal mail API used to enumerate inbox messages which can be abused after XSS to exfiltrate emails.	CWE-79
_action	query param	/?_task=mail&_action=list	Roundcube internal mail API used to enumerate inbox messages which can be abused after XSS to exfiltrate emails.	CWE-79
uid	query param	/?_task=mail&_action=list	Roundcube internal mail API used to enumerate inbox messages which can be abused after XSS to exfiltrate emails.	CWE-79
_action	query param	/?_action=show	Roundcube internal mail API endpoint used to retrieve message content which may be exploited after XSS.	CWE-79
uid	query param	/?_action=show	Roundcube internal mail API endpoint used to retrieve message content which may be exploited after XSS.	CWE-79

17 Jun 2026 07:48Current

6Medium risk

Vulners AI Score6

CVSS 3.19.3

EPSS0.82882

SSVC