Roundcube · Webmail
CVE-2024-42009
RoundCube Webmail Cross-Site Scripting Vulnerability
무엇인가
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
CISA: RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
할 일
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
미국 연방 기관 조치 기한: 2025년 6월 30일
- CISA 목록에 추가됨
- 2025년 6월 9일
- 게시됨
- 2024년 8월 5일
- 심각도
- 치명적 9.3 CVSS 3.1
- 향후 30일 내 공격 가능성(EPSS)
- 83% 알려진 모든 취약점 중 상위 0.3%
- 약점 유형
- CWE-79
- 자세히
- NVD · CVE.org · CISA
모든 참고 자료(5)
- https://github.com/roundcube/roundcubemail/releases
- https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcu…
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.8
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.8
- https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8
Roundcube의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2026. 2. 20. | Deserialization of Untrusted Data | Webmail | 치명적 9.9 | 99.7% |
| 2026. 2. 20. | Cross-site Scripting | Webmail | 높음 7.2 | 27% |
| 2024. 10. 24. | Cross-Site Scripting (XSS) | Webmail | 보통 6.1 | 74% |
| 2024. 6. 26. | Cross-Site Scripting (XSS) | Webmail | 보통 6.3 | 77% |
| 2024. 2. 12. | Persistent Cross-Site Scripting (XSS) | Webmail | 보통 6.1 | 64% |
| 2023. 10. 26. | Persistent Cross-Site Scripting (XSS) | Webmail | 보통 6.1 | 76% |
| 2023. 6. 22. | Webmail Remote Code Execution | Roundcube Webmail | 치명적 9.8 | 84% |
| 2023. 6. 22. | Webmail Cross-Site Scripting (XSS) | Roundcube Webmail | 보통 6.1 | 33% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.