Every CVE Search/ Get API key

CVE-2024-42008

A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7...

9.3 CriticalPublic exploitFix available

A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

34.2%Up 34.2 points since Aug 6, 2024
90%50%10%1%

What each source reports

NVD Score used 9.3

A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.

Record
CVE-2024-42008
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List 9.3

A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.

Record
CVE-2024-42008
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2024-39390 9.3

A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.

Record
EUVD-2024-39390
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-78jf-j6qx-c7j3 9.3

A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7...

A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.

Record
GHSA-78jf-j6qx-c7j3
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 9.3

A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.

Record
CVE-2024-42008
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2024-42008 9.3

A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.

Record
DEBIAN-CVE-2024-42008
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2024-42008 9.3

A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.

Record
UBUNTU-CVE-2024-42008
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVMGASA-2024-0279 No score

Updated roundcubemail packages fix security vulnerabilities

Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009] Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008] Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]

Record
MGASA-2024-0279
Updated
2026-11-02
OSVopenSUSE-SU-2024:0328-1 No score

Security update for roundcubemail

This update for roundcubemail fixes the following issues:

Update to 1.6.8 This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities:

  • Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
  • Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
  • Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]

CHANGELOG

  • Managesieve: Protect special scripts in managesieve_kolab_master mode
  • Fix newmail_notifier notification focus in Chrome (#9467)
  • Fix fatal error when parsing some TNEF attachments (#9462)
  • Fix double scrollbar when composing a mail with many plain text lines (#7760)
  • Fix decoding mail parts with multiple base64-encoded text blocks (#9290)
  • Fix bug where some messages could get malformed in an import from a MBOX file (#9510)
  • Fix invalid line break characters in multi-line text in Sieve scripts (#9543)
  • Fix bug where 'with attachment' filter could fail on some fts engines (#9514)
  • Fix bug where an unhandled exception was caused by an invalid image attachment (#9475)
  • Fix bug where a long subject title could not be displayed in some cases (#9416)
  • Fix infinite loop when parsing malformed Sieve script (#9562)
  • Fix bug where imap_conn_option's 'socket' was ignored (#9566)
  • Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
  • Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
  • Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]
Record
openSUSE-SU-2024:0328-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14243-1 No score

roundcubemail-1.6.8-1.1 on GA media

These are all security issues fixed in the roundcubemail-1.6.8-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14243-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
roundcube
Debian:12
 before 1.6.5+dfsg-1+deb12u3, plus listed versions
1.6.1+dfsg-11.6.2+dfsg-11.6.3+dfsg-11.6.3+dfsg-1~deb12u11.6.3+dfsg-2
Show 5 moreShow less
1.6.4+dfsg-11.6.4+dfsg-1~deb12u11.6.5+dfsg-11.6.5+dfsg-1+deb12u21.6.5+dfsg-1~deb12u1
1.6.5+dfsg-1+deb12u3
roundcube
Debian:13
 before 1.6.8+dfsg-1
1.6.8+dfsg-1
roundcube
Debian:14
 before 1.6.8+dfsg-1
1.6.8+dfsg-1
roundcube
Debian:12
From an advisory covering 3 CVEs
 before 1.6.5+dfsg-1+deb12u3, plus listed versions
1.6.1+dfsg-11.6.2+dfsg-11.6.3+dfsg-11.6.3+dfsg-1~deb12u11.6.3+dfsg-2
Show 5 moreShow less
1.6.4+dfsg-11.6.4+dfsg-1~deb12u11.6.5+dfsg-11.6.5+dfsg-1+deb12u21.6.5+dfsg-1~deb12u1
1.6.5+dfsg-1+deb12u3
roundcube
Debian:11
From an advisory covering 3 CVEs
 before 1.4.15+dfsg.1-1+deb11u4, plus listed versions
1.4.11+dfsg.1-41.4.12+dfsg.1-1~bpo10+11.4.12+dfsg.1-1~deb11u11.4.13+dfsg.1-1~deb11u11.4.13+dfsg.1-1~deb11u1~bpo10+1
Show 7 moreShow less
1.4.14+dfsg.1-1~deb11u11.4.14+dfsg.1-1~deb11u1~bpo10+11.4.15+dfsg.1-1+deb11u31.4.15+dfsg.1-1~deb11u11.4.15+dfsg.1-1~deb11u1~bpo10+11.4.15+dfsg.1-1~deb11u21.4.15+dfsg.1-1~deb11u2~bpo10+1
1.4.15+dfsg.1-1+deb11u4
roundcubemail
Mageia:9
From an advisory covering 3 CVEs
 before 1.6.8-1.mga9
1.6.8-1.mga9
roundcube
Ubuntu:Pro:22.04:LTS
 before 1.5.0+dfsg.1-2ubuntu0.1~esm6, plus listed versions
1.4.11+dfsg.1-41.5.0+dfsg.1-21.5.0+dfsg.1-2ubuntu0.1~esm11.5.0+dfsg.1-2ubuntu0.1~esm21.5.0+dfsg.1-2ubuntu0.1~esm31.5.0+dfsg.1-2ubuntu0.1~esm41.5.0+dfsg.1-2ubuntu0.1~esm5
1.5.0+dfsg.1-2ubuntu0.1~esm6
roundcube
Ubuntu:Pro:24.04:LTS
 before 1.6.6+dfsg-2ubuntu0.1+esm3, plus listed versions
1.6.2+dfsg-11.6.4+dfsg-11.6.5+dfsg-11.6.6+dfsg-11.6.6+dfsg-21.6.6+dfsg-2ubuntu0.11.6.6+dfsg-2ubuntu0.1+esm11.6.6+dfsg-2ubuntu0.1+esm2
1.6.6+dfsg-2ubuntu0.1+esm3
roundcubemail
SUSE:Package Hub 15 SP5
From an advisory covering 3 CVEs
 before 1.6.8-bp156.2.3.1
1.6.8-bp156.2.3.1
roundcubemail
SUSE:Package Hub 15 SP6
From an advisory covering 3 CVEs
 before 1.6.8-bp156.2.3.1
1.6.8-bp156.2.3.1
roundcubemail
openSUSE:Leap 15.5
From an advisory covering 3 CVEs
 before 1.6.8-bp156.2.3.1
1.6.8-bp156.2.3.1
roundcubemail
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 1.6.8-bp156.2.3.1
1.6.8-bp156.2.3.1
roundcubemail
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 1.6.8-1.1
1.6.8-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubvictoni/Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC2025-02-13
PoC in GitHubFoxer131/CVE-2024-42008-9-exploit2025-05-26
PoC in GitHubrpgsec/Roundcube-CVE-2024-42008-POC2025-07-09

History

History
RecordedChangedSources
affected, exploits, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-42008 is a critical vulnerability (CVSS 9.3) in Roundcube Webmail, published August 5, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 34.2%, the 98th percentile. Fixed in roundcube 1.6.5+dfsg-1+deb12u3.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open