CVE-2024-42010

HIGH

Roundcube <1.5.7, <1.6.0-1.6.7 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-42010. PoCs published by victoni.

AI-analyzed exploit summary This repository contains a functional proof-of-concept for exploiting CVE-2024-42008 (XSS via malicious XML attachment) and CVE-2024-42010 (HTML exfiltration via CSS injection) in Roundcube Webmail. The PoC includes a JavaScript server to exfiltrate the UID of the malicious attachment.

Description

mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.

Exploits (1)

github WORKING POC 2 stars
by victoni · javascriptpoc
https://github.com/victoni/Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC

This repository contains a functional proof-of-concept for exploiting CVE-2024-42008 (XSS via malicious XML attachment) and CVE-2024-42010 (HTML exfiltration via CSS injection) in Roundcube Webmail. The PoC includes a JavaScript server to exfiltrate the UID of the malicious attachment.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Moderate
Reliability
Reliable
Target: Roundcube Webmail
No auth needed
Prerequisites: Ability to send emails to the target Roundcube instance · Hosting a domain starting with 'a' for CSS injection
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (5)

Core 5

Scores

CVSS v3 7.5
EPSS 0.5253
EPSS Percentile 98.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-200
Status published
Published Aug 05, 2024
Tracked Since Feb 18, 2026