CVE-2024-42009

criticalpriority · act · 90OT risk · criticalKEV · exploitedEU KEV · CERT-PLEPSS 0.829 · 100 %ileexploit · PoCDEEUNLRUUS
grimoire priorityP0 · Act now
Exploitable?
Yes · in the wild
CISA KEV · 6 exploits · PoC
Likely / severe?
82.9% (100th) EPSS
CVSS 9.3 · critical
Is it mine?
13 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2025-06-09remediate by 2025-06-30

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EU KEVflagged by CERT-PLreported 2026-04-27patched 2024-08-04APT

EPSS · scored 2026-10-26

RoundCube Webmail Cross-Site Scripting Vulnerability

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

01

cvss

Technical severity, 0–10. One row per scoring source.

9.3
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 5.8
v3.19.3criticalAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU
v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Nsecondary · ENISA EU
v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Nsecondaryexploitability 2.8 · impact 5.8
v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:Hsecondary · CVSS-BT (t0sche)
02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USprimaryCWE-79US
04

ATT&CK techniques

ATT&CK techniques this enables or maps to.

05

exploits (6)

Public proof-of-concept and weaponised exploit code.

06

affected products (13)

Products and version ranges known to be affected.

07

advisories (2)

Vendor and ecosystem advisories describing this.

  • NCSC-2024-0326Kwetsbaarheden verholpen in RoundCube WebmailNL2024-08-08csaf · ncsc_nlNL

    Er zijn kwetsbaarheden verholpen in RoundCube Webmail.

  • WID-SEC-W-2024-1754Roundcube: Mehrere SchwachstellenDeutsch2024-08-04csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Roundcube ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und vertrauliche Informationen preiszugeben.

08

also known as (4)

Other names and identifiers for this entity.

09

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducert_bundnvdncsc_nlNVDCVE.orgMITRE
published 2024-08-05modified 2026-06-17
11

references (17)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan