CVE-2024-42010

Published: Aug 5, 2024Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (5)

https://github.com/roundcube/roundcubemail/releases

Source: cve@mitre.org

https://github.com/roundcube/roundcubemail/releases/tag/1.5.8

Source: cve@mitre.org

https://github.com/roundcube/roundcubemail/releases/tag/1.6.8

Source: cve@mitre.org

https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8

Source: cve@mitre.org

https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/

Source: cve@mitre.org

Timeline

No history available yet.