{"id":"CVE-2024-42008","aliases":["DEBIAN-CVE-2024-42008","DSA-5743-1","DSA-5743-2","EUVD-2024-39390","GHSA-78jf-j6qx-c7j3","MGASA-2024-0279","UBUNTU-CVE-2024-42008","openSUSE-SU-2024:0328-1","openSUSE-SU-2024:14243-1"],"status":"published","title":"A Cross-Site Scripting vulnerability in rcmail_action_mail_get-\u003erun() in Roundcube through 1.5.7...","description":"A Cross-Site Scripting vulnerability in rcmail_action_mail_get-\u003erun() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.","severity":{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.33969,"percentile":0.98407,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2024-08-05T00:00:00Z","modified":"2026-11-02T12:02:58Z","exploits":[{"source":"pocgithub","id":"victoni/Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC","title":"victoni/Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC","date":"2025-02-13","url":"https://github.com/victoni/Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC"},{"source":"pocgithub","id":"Foxer131/CVE-2024-42008-9-exploit","title":"Foxer131/CVE-2024-42008-9-exploit","date":"2025-05-26","url":"https://github.com/Foxer131/CVE-2024-42008-9-exploit"},{"source":"pocgithub","id":"rpgsec/Roundcube-CVE-2024-42008-POC","title":"rpgsec/Roundcube-CVE-2024-42008-POC","date":"2025-07-09","url":"https://github.com/rpgsec/Roundcube-CVE-2024-42008-POC"}],"fixes":[{"ecosystem":"Debian:12","package":"roundcube","fixed_in":["1.6.5+dfsg-1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"roundcube","fixed_in":["1.6.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"roundcube","fixed_in":["1.6.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","fixed_in":["1.5.0+dfsg.1-2ubuntu0.1~esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"roundcube","fixed_in":["1.6.6+dfsg-2ubuntu0.1+esm3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u3"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1","1.6.5+dfsg-1","1.6.5+dfsg-1+deb12u2","1.6.5+dfsg-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u3"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1","1.6.5+dfsg-1","1.6.5+dfsg-1+deb12u2","1.6.5+dfsg-1~deb12u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15+dfsg.1-1+deb11u4"}]}],"versions":["1.4.11+dfsg.1-4","1.4.12+dfsg.1-1~bpo10+1","1.4.12+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1~bpo10+1","1.4.14+dfsg.1-1~deb11u1","1.4.14+dfsg.1-1~deb11u1~bpo10+1","1.4.15+dfsg.1-1+deb11u3","1.4.15+dfsg.1-1~deb11u1","1.4.15+dfsg.1-1~deb11u1~bpo10+1","1.4.15+dfsg.1-1~deb11u2","1.4.15+dfsg.1-1~deb11u2~bpo10+1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0+dfsg.1-2ubuntu0.1~esm6"}]}],"versions":["1.4.11+dfsg.1-4","1.5.0+dfsg.1-2","1.5.0+dfsg.1-2ubuntu0.1~esm1","1.5.0+dfsg.1-2ubuntu0.1~esm2","1.5.0+dfsg.1-2ubuntu0.1~esm3","1.5.0+dfsg.1-2ubuntu0.1~esm4","1.5.0+dfsg.1-2ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6+dfsg-2ubuntu0.1+esm3"}]}],"versions":["1.6.2+dfsg-1","1.6.4+dfsg-1","1.6.5+dfsg-1","1.6.6+dfsg-1","1.6.6+dfsg-2","1.6.6+dfsg-2ubuntu0.1","1.6.6+dfsg-2ubuntu0.1+esm1","1.6.6+dfsg-2ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-bp156.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-bp156.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-bp156.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-bp156.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-1.1"}]}],"bundled":3}],"products":[{"vendor":"roundcube","product":"webmail"}],"references":[{"url":"https://github.com/roundcube/roundcubemail/releases","tags":["Release Notes","package","report"]},{"url":"https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/","tags":["Technical Description","article","report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.8","tags":["Release Notes","web","report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.8","tags":["Release Notes","web","report"]},{"url":"https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8","tags":["Vendor Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42008","tags":["advisory"]},{"url":"https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail"},{"url":"https://github.com/advisories/GHSA-78jf-j6qx-c7j3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42008.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-42008","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0279.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33460","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42008","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-42008","tags":["report"]},{"url":"https://github.com/roundcube/roundcubemail/commit/89c8fe9ae9318c015807fbcbf7e39555fb30885d","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8223-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Q5GOCYS6W7WGAIH6NILISNVXQC4O7Z53/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228900","tags":["report"]},{"url":"https://bugzilla.suse.com/1228901","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42010","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-42008","description":"A Cross-Site Scripting vulnerability in rcmail_action_mail_get-\u003erun() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.","status":"published","published":"2024-08-05T00:00:00Z","modified":"2025-03-13T15:35:39.477Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:03.333404Z"}],"euvd":[{"id":"EUVD-2024-39390","description":"A Cross-Site Scripting vulnerability in rcmail_action_mail_get-\u003erun() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.","status":"published","published":"2024-08-05T00:00:00Z","modified":"2025-03-13T15:35:39Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T20:53:04.82001Z"}],"ghsa":[{"id":"GHSA-78jf-j6qx-c7j3","title":"A Cross-Site Scripting vulnerability in rcmail_action_mail_get-\u003erun() in Roundcube through 1.5.7...","description":"A Cross-Site Scripting vulnerability in rcmail_action_mail_get-\u003erun() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.","status":"published","published":"2024-08-05T21:31:19Z","modified":"2024-09-07T00:32:35Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:58:11.86243Z"}],"nvd":[{"id":"CVE-2024-42008","description":"A Cross-Site Scripting vulnerability in rcmail_action_mail_get-\u003erun() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.","status":"published","published":"2024-08-05T19:15:38.153Z","modified":"2026-06-17T07:48:37.767Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:17.832118Z"}],"osv":[{"id":"CVE-2024-42008","description":"A Cross-Site Scripting vulnerability in rcmail_action_mail_get-\u003erun() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.","status":"published","published":"2024-08-05T00:00:00Z","modified":"2026-10-28T02:30:22.240528367Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:44:41.963899Z"},{"id":"DEBIAN-CVE-2024-42008","description":"A Cross-Site Scripting vulnerability in rcmail_action_mail_get-\u003erun() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.","status":"published","published":"2024-08-05T19:15:38.153Z","modified":"2026-11-02T12:02:58.877860083Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"UBUNTU-CVE-2024-42008","description":"A Cross-Site Scripting vulnerability in rcmail_action_mail_get-\u003erun() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.","status":"published","published":"2024-08-05T19:15:00Z","modified":"2026-04-30T09:43:58.607877Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"},{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"DSA-5743-1","title":"roundcube - security update","status":"published","published":"2024-08-08T00:00:00Z","modified":"2026-03-09T02:09:39.888358Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"DSA-5743-2","title":"roundcube - security update","status":"published","published":"2024-08-13T00:00:00Z","modified":"2026-03-09T02:11:29.044594Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0279","title":"Updated roundcubemail packages fix security vulnerabilities","description":"Fix XSS vulnerability in post-processing of sanitized HTML content\n[CVE-2024-42009]\nFix XSS vulnerability in serving of attachments other than HTML or SVG\n[CVE-2024-42008]\nFix information leak (access to remote content) via insufficient CSS\nfiltering [CVE-2024-42010]\n","status":"published","published":"2024-08-15T17:48:28Z","modified":"2026-04-16T04:43:50.841274176Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:0328-1","title":"Security update for roundcubemail","description":"This update for roundcubemail fixes the following issues:\n\nUpdate to 1.6.8\nThis is a security update to the stable version 1.6 of Roundcube Webmail.\nIt provides fixes to recently reported security vulnerabilities:\n\n  * Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]\n  * Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]\n  * Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]\n\n  CHANGELOG\n\n  * Managesieve: Protect special scripts in managesieve_kolab_master mode\n  * Fix newmail_notifier notification focus in Chrome (#9467)\n  * Fix fatal error when parsing some TNEF attachments (#9462)\n  * Fix double scrollbar when composing a mail with many plain text lines (#7760)\n  * Fix decoding mail parts with multiple base64-encoded text blocks (#9290)\n  * Fix bug where some messages could get malformed in an import from a MBOX file (#9510)\n  * Fix invalid line break characters in multi-line text in Sieve scripts (#9543)\n  * Fix bug where 'with attachment' filter could fail on some fts engines (#9514)\n  * Fix bug where an unhandled exception was caused by an invalid image attachment (#9475)\n  * Fix bug where a long subject title could not be displayed in some cases (#9416)\n  * Fix infinite loop when parsing malformed Sieve script (#9562)\n  * Fix bug where imap_conn_option's 'socket' was ignored (#9566)\n  * Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]\n  * Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]\n  * Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]\n","status":"published","published":"2024-10-09T08:01:27Z","modified":"2026-02-04T03:46:01.312116Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:14243-1","title":"roundcubemail-1.6.8-1.1 on GA media","description":"These are all security issues fixed in the roundcubemail-1.6.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-07T00:00:00Z","modified":"2026-02-04T02:22:21.707193Z","updated_at":"2026-11-02T16:58:36.662953Z"}]}}