CVE-2024-42010

HIGH

Roundcube <1.5.7, <1.6.0-1.6.7 - Info Disclosure

Title source: llm

Description

mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.

Exploits (1)

github WORKING POC 2 stars

by victoni · javascriptpoc

https://github.com/victoni/Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC

View Code ZIP pw:eip

References (5)

[Various Sources] https://github.com/roundcube/roundcubemail/releases

[Various Sources] https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8

[Various Sources] https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/

[Release Notes] https://github.com/roundcube/roundcubemail/releases/tag/1.5.8

[Release Notes] https://github.com/roundcube/roundcubemail/releases/tag/1.6.8

Scores

CVSS v3 7.5

EPSS 0.1476

EPSS Percentile 94.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Published Aug 05, 2024

Tracked Since Feb 18, 2026