CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2024-42009

CVSS 9.3v3.1pub. 2024-08-05upd. 2025-11-04

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
  • Roundcube Webmail

    APP
    Roundcube
    < 1.5.81.6.0 – 1.6.8 (bez)

CISA KEV — detailsi

Vendori
Roundcube
Producti
Webmail
Added to KEVi
June 9, 2025
Remediation deadline (US Federal)i
June 30, 2025(overdue)
Required action (CISA)i

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA descriptioni

RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
CISA DEADLINE: 30 czerwca 2025
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2025-49113CRITICAL9.9⚠ KEVPL ✓ten sam produkt

RCE przez deserializację PHP w Roundcube Webmail (parametr _from)

CVE-2021-44026CRITICAL9.8⚠ KEVten sam produkt

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_par...

CVE-2020-12641CRITICAL9.8⚠ KEVten sam produkt

rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacha...

CVE-2024-42008CRITICAL9.3PL ✓ten sam produkt

XSS w Roundcube Webmail umożliwiający kradzież i wysyłkę e-maili ofiary

CVE-2024-37385CRITICAL9.8PL ✓ten sam produkt

Command injection w Roundcube Webmail na Windows (im_convert_path/im_identify_path)