Vulnerabilitycritical

Roundcube Webmail Flaws Allow Hackers to Steal Emails and Passwords

The Hacker Newsby @TheHackersNewsAug 7, 2024 · 13:29 UTC (Aug 7, 2024)2 min read2 · 1 read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2024-42008 CVE-2024-42009 CVE-2024-42010 CVE-2024-41637

Tags: cve-2024-42008 cve-2024-42009 cve-2024-42010 cve-2024-41637 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2024-41637	RaspAP before 3.1.5 allows an attacker to escalate privileges	8.3	<1%		Jul 29, 2024
CVE-2024-42009 +1 related CVE CVE-2024-42008	Cross-Site Scripting in Roundcube Webmail Lets Attackers Steal Emails	9.3	83%	KEV	Aug 5, 2024 KEV Jun 9, 2025
CVE-2024-42010	mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail…	7.5	53%		Aug 5, 2024

From the original article

2 min read at thehackernews.com

 Ravie Lakshmanan  Aug 07, 2024 Email Security / Vulnerability Cybersecurity researchers have disclosed details of security flaws in the Roundcube webmail software that could be exploited to execute malicious JavaScript in a victim's web browser and steal sensitive information from their account under specific circumstances.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.