CVE-2024-42008

Aug. 5, 2024, 7:15 p.m.

None
No Score

Description

A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.

Product(s) Impacted

Product Versions
Roundcube
  • ['1.5.7', '1.6.x - 1.6.7']

Weaknesses

Common security weaknesses mapped to this vulnerability.

References

https://github.com/roundcube/roundcubemail/releases
https://github.com/roundcube/roundcubemail/releases/tag/1.5.8
https://github.com/roundcube/roundcubemail/releases/tag/1.6.8
https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8
https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/

Tags

cve@mitre.org
2024-08-05
CVE-2024-42008

Timeline

Published: Aug. 5, 2024, 7:15 p.m.
Last Modified: Aug. 5, 2024, 7:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.