{"id":"CVE-2024-42009","aliases":["DEBIAN-CVE-2024-42009","DSA-5743-1","DSA-5743-2","EUVD-2024-39391","GHSA-j43g-prf4-578j","MGASA-2024-0279","UBUNTU-CVE-2024-42009","USN-7636-1","openSUSE-SU-2024:0328-1","openSUSE-SU-2024:14243-1"],"status":"published","title":"A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a...","description":"A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.","severity":{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.82882,"percentile":0.99675,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2024-08-05T00:00:00Z","modified":"2026-11-02T12:02:58Z","kev":{"date_added":"2025-06-09","due_date":"2025-06-30","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2025-06-09"},{"source":"kev","since":"2025-06-09"}],"exploits":[{"source":"pocgithub","id":"0xbassiouny1337/CVE-2024-42009","title":"0xbassiouny1337/CVE-2024-42009","date":"2025-02-11","url":"https://github.com/0xbassiouny1337/CVE-2024-42009"},{"source":"pocgithub","id":"Bhanunamikaze/CVE-2024-42009","title":"Bhanunamikaze/CVE-2024-42009","date":"2025-02-13","url":"https://github.com/Bhanunamikaze/CVE-2024-42009"},{"source":"pocgithub","id":"DaniTheHack3r/CVE-2024-42009-PoC","title":"DaniTheHack3r/CVE-2024-42009-PoC","date":"2025-05-24","url":"https://github.com/DaniTheHack3r/CVE-2024-42009-PoC"},{"source":"pocgithub","id":"Shubhankargupta691/CVE-2024-42009","title":"Shubhankargupta691/CVE-2024-42009","date":"2025-09-14","url":"https://github.com/Shubhankargupta691/CVE-2024-42009"},{"source":"pocgithub","id":"ZaidArif47/CVE-2024-42009","title":"ZaidArif47/CVE-2024-42009","date":"2026-04-16","url":"https://github.com/ZaidArif47/CVE-2024-42009"},{"source":"pocgithub","id":"segunakinsoyinu/CVE-2024-42009-roundcube-xss","title":"segunakinsoyinu/CVE-2024-42009-roundcube-xss","date":"2026-06-17","url":"https://github.com/segunakinsoyinu/CVE-2024-42009-roundcube-xss"},{"source":"nuclei","id":"CVE-2024-42009","title":"Roundcube Webmail - Cross-Site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-42009.yaml"}],"fixes":[{"ecosystem":"Debian:12","package":"roundcube","fixed_in":["1.6.5+dfsg-1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"roundcube","fixed_in":["1.6.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"roundcube","fixed_in":["1.6.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"roundcube","fixed_in":["1.6.6+dfsg-2ubuntu0.1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u3"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1","1.6.5+dfsg-1","1.6.5+dfsg-1+deb12u2","1.6.5+dfsg-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u3"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1","1.6.5+dfsg-1","1.6.5+dfsg-1+deb12u2","1.6.5+dfsg-1~deb12u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15+dfsg.1-1+deb11u4"}]}],"versions":["1.4.11+dfsg.1-4","1.4.12+dfsg.1-1~bpo10+1","1.4.12+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1~bpo10+1","1.4.14+dfsg.1-1~deb11u1","1.4.14+dfsg.1-1~deb11u1~bpo10+1","1.4.15+dfsg.1-1+deb11u3","1.4.15+dfsg.1-1~deb11u1","1.4.15+dfsg.1-1~deb11u1~bpo10+1","1.4.15+dfsg.1-1~deb11u2","1.4.15+dfsg.1-1~deb11u2~bpo10+1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6+dfsg-2ubuntu0.1+esm1"}]}],"versions":["1.6.2+dfsg-1","1.6.4+dfsg-1","1.6.5+dfsg-1","1.6.6+dfsg-1","1.6.6+dfsg-2","1.6.6+dfsg-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6+dfsg-2ubuntu0.1+esm1"}]}],"versions":["1.6.2+dfsg-1","1.6.4+dfsg-1","1.6.5+dfsg-1","1.6.6+dfsg-1","1.6.6+dfsg-2","1.6.6+dfsg-2ubuntu0.1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-bp156.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-bp156.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-bp156.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-bp156.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-1.1"}]}],"bundled":3}],"products":[{"vendor":"roundcube","product":"webmail"}],"references":[{"url":"https://github.com/roundcube/roundcubemail/releases","tags":["Release Notes","package","report"]},{"url":"https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/","tags":["Technical Description","Third Party Advisory","article","report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.8","tags":["Release Notes","web","report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.8","tags":["Release Notes","web","report"]},{"url":"https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8","tags":["Vendor Advisory","web","report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-42009","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42009","tags":["advisory"]},{"url":"https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail"},{"url":"https://github.com/advisories/GHSA-j43g-prf4-578j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42009.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-42009","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0279.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33460","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42009","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-42009","tags":["report"]},{"url":"https://github.com/roundcube/roundcubemail/commit/68af7c864a36e1941764238dac440ab0d99a8d26","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7636-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Q5GOCYS6W7WGAIH6NILISNVXQC4O7Z53/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228900","tags":["report"]},{"url":"https://bugzilla.suse.com/1228901","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42010","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-42009","description":"A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.","status":"published","published":"2024-08-05T00:00:00Z","modified":"2025-10-21T22:55:48.964Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:03.00063Z"}],"euvd":[{"id":"EUVD-2024-39391","description":"A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.","status":"published","published":"2024-08-05T00:00:00Z","modified":"2025-10-21T22:55:48Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"exploited_since":"2025-06-09","updated_at":"2026-11-02T20:31:28.525814Z"}],"ghsa":[{"id":"GHSA-j43g-prf4-578j","title":"A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a...","description":"A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.","status":"published","published":"2024-08-05T21:31:19Z","modified":"2025-10-22T00:34:11Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:04:08.734574Z"}],"kev":[{"id":"CVE-2024-42009","title":"RoundCube Webmail Cross-Site Scripting Vulnerability","description":"RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.","cwes":["CWE-79"],"kev":{"date_added":"2025-06-09","due_date":"2025-06-30","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2024-42009","description":"A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.","status":"published","published":"2024-08-05T19:15:38.22Z","modified":"2026-06-17T07:48:37.93Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:17.832118Z"}],"osv":[{"id":"CVE-2024-42009","description":"A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.","status":"published","published":"2024-08-05T00:00:00Z","modified":"2026-10-28T02:30:37.646565555Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:44:41.963899Z"},{"id":"DEBIAN-CVE-2024-42009","description":"A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.","status":"published","published":"2024-08-05T19:15:38.22Z","modified":"2026-11-02T12:02:58.998364282Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"UBUNTU-CVE-2024-42009","description":"A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.","status":"published","published":"2024-08-05T19:15:00Z","modified":"2026-02-04T04:36:16.240956Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"},{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"DSA-5743-1","title":"roundcube - security update","status":"published","published":"2024-08-08T00:00:00Z","modified":"2026-03-09T02:09:39.888358Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"DSA-5743-2","title":"roundcube - security update","status":"published","published":"2024-08-13T00:00:00Z","modified":"2026-03-09T02:11:29.044594Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0279","title":"Updated roundcubemail packages fix security vulnerabilities","description":"Fix XSS vulnerability in post-processing of sanitized HTML content\n[CVE-2024-42009]\nFix XSS vulnerability in serving of attachments other than HTML or SVG\n[CVE-2024-42008]\nFix information leak (access to remote content) via insufficient CSS\nfiltering [CVE-2024-42010]\n","status":"published","published":"2024-08-15T17:48:28Z","modified":"2026-04-16T04:43:50.841274176Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:0328-1","title":"Security update for roundcubemail","description":"This update for roundcubemail fixes the following issues:\n\nUpdate to 1.6.8\nThis is a security update to the stable version 1.6 of Roundcube Webmail.\nIt provides fixes to recently reported security vulnerabilities:\n\n  * Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]\n  * Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]\n  * Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]\n\n  CHANGELOG\n\n  * Managesieve: Protect special scripts in managesieve_kolab_master mode\n  * Fix newmail_notifier notification focus in Chrome (#9467)\n  * Fix fatal error when parsing some TNEF attachments (#9462)\n  * Fix double scrollbar when composing a mail with many plain text lines (#7760)\n  * Fix decoding mail parts with multiple base64-encoded text blocks (#9290)\n  * Fix bug where some messages could get malformed in an import from a MBOX file (#9510)\n  * Fix invalid line break characters in multi-line text in Sieve scripts (#9543)\n  * Fix bug where 'with attachment' filter could fail on some fts engines (#9514)\n  * Fix bug where an unhandled exception was caused by an invalid image attachment (#9475)\n  * Fix bug where a long subject title could not be displayed in some cases (#9416)\n  * Fix infinite loop when parsing malformed Sieve script (#9562)\n  * Fix bug where imap_conn_option's 'socket' was ignored (#9566)\n  * Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]\n  * Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]\n  * Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]\n","status":"published","published":"2024-10-09T08:01:27Z","modified":"2026-02-04T03:46:01.312116Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:14243-1","title":"roundcubemail-1.6.8-1.1 on GA media","description":"These are all security issues fixed in the roundcubemail-1.6.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-07T00:00:00Z","modified":"2026-02-04T02:22:21.707193Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"USN-7636-1","title":"roundcube vulnerability","description":"It was discovered that Roundcube Webmail incorrectly handled sanitization in\nthe message_body function. A remote attacker could possibly use this issue to\nsend and receive emails as another user.","status":"published","published":"2025-07-14T14:36:20Z","modified":"2026-04-27T18:09:25.225812Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}