Vulnerabilities CVE-2024-42009

CVE-2024-42009

Medium

Open

KEV

TLP:CLEAR

RoundCube Webmail Cross-Site Scripting Vulnerability

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Roundcube — Webmail — RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Details

EPSS Score ⓘ: 79.62%

99.6th percentile
Confidence: 100%
CISA KEV
Date Added: Jun 9, 2025
Patch Due: Jun 30, 2025
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.