Roundcube · Webmail
CVE-2024-42009
RoundCube Webmail Cross-Site Scripting Vulnerability
Qué es
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
CISA: RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
Qué hacer
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Plazo para las agencias federales de EE. UU.: 30 de junio de 2025
- Añadida a la lista de CISA
- 9 de junio de 2025
- Publicada
- 5 de agosto de 2024
- Gravedad
- Crítica 9,3 CVSS 3.1
- Probabilidad de ataques en los próximos 30 días (EPSS)
- 83% entre el 0,3% superior de todas las vulnerabilidades conocidas
- Debilidad
- CWE-79
- Más detalles
- NVD · CVE.org · CISA
Todas las referencias (5)
- https://github.com/roundcube/roundcubemail/releases
- https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcu…
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.8
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.8
- https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8
Más fallos explotados de Roundcube
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 20 feb 2026 | Deserialization of Untrusted Data | Webmail | Crítica 9,9 | 99,7% |
| 20 feb 2026 | Cross-site Scripting | Webmail | Alto 7,2 | 27% |
| 24 oct 2024 | Cross-Site Scripting (XSS) | Webmail | Media 6,1 | 74% |
| 26 jun 2024 | Cross-Site Scripting (XSS) | Webmail | Media 6,3 | 77% |
| 12 feb 2024 | Persistent Cross-Site Scripting (XSS) | Webmail | Media 6,1 | 64% |
| 26 oct 2023 | Persistent Cross-Site Scripting (XSS) | Webmail | Media 6,1 | 76% |
| 22 jun 2023 | Webmail Remote Code Execution | Roundcube Webmail | Crítica 9,8 | 84% |
| 22 jun 2023 | Webmail Cross-Site Scripting (XSS) | Roundcube Webmail | Media 6,1 | 33% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.