Roundcube flaws allow easy email account compromise (CVE-2024-42009, CVE-2024-42008)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-35730 | Cross-Site Scripting in Roundcube Webmail Plain-Text Email Link Handling | 6.1 | 33% | KEV | KEV |
| CVE-2021-44026 | SQL Injection in Roundcube Webmail via Search Parameters | 9.8 | 70% | KEV | KEV |
| CVE-2023-43770 | Persistent Cross-Site Scripting in Roundcube Webmail (Exploited in the Wild) | 6.1 | 64% | KEV | KEV |
| CVE-2023-5631 | Stored XSS in Roundcube Webmail exploited in the wild (CVE-2023-5631) | 5.4 | 76% | KEVPoC | KEV |
CVE-2024-42009+1 related CVE | Cross-Site Scripting in Roundcube Webmail Lets Attackers Steal Emails | 9.3 | 83% | KEV | KEV |
| CVE-2024-42010 | mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail… | 7.5 | 53% |
From the original article
2 min read at helpnetsecurity.com
Two cross-site scripting vulnerabilities (CVE-2024-42009, CVE-2024-42008) affecting Roundcube could be exploited by attackers to steal users’ emails and contacts, email password, and send emails from their account. Roundcube is an open-source webmail software solution popular with European government agencies, hosting providers and academic institutions around the world.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.