This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Roundcube Webmail fixes 3 vulnerabilities

Roundcube Webmail fixes 3 vulnerabilities in versions 1.6.8 and 1.5.8 [1][2]. Gentoo has the fixed version 1.6.9 available as testing [3]. Individual Debian releases and fixed versions [4]: bullseye - 1.4.15+dfsg.1-1+deb11u4 bookworm - 1.6.5+dfsg-1+deb12u4 trixie, sid - 1.6.9+dfsg-1

Roundcube - XSS (CVE-2024-42009)
CVSS 9.3 (Critical)

An unauthenticated remote attacker can carry out an XSS attack by sending a specially crafted e-mail, which would allow them to send e-mails impersonating the victim and to steal the victim's e-mails, contacts and mail account password. After exploiting the vulnerability, the attacker is able to ensure persistence. More information about the vulnerability can be found at [5].

The vulnerability is present in product:

  • Roundcube Webmail; <1.5.8; >=1.6, <1.6.8;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

More information:

  • CVE-2024-42009 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 5. 8. 2024.

Roundcube - XSS (CVE-2024-42008)
CVSS 9.3 (Critical)

An unauthenticated remote attacker can carry out an XSS attack by sending an e-mail with a specially crafted attachment, which would allow them to send e-mails impersonating the victim and to steal the victim's e-mails, contacts and mail account password. After exploiting the vulnerability, the attacker is able to ensure persistence. More information about the vulnerability can be found at [5]. To be successfully exploited, this vulnerability needs to be combined with the vulnerability CVE-2024-42010 [5].

The vulnerability is present in product:

  • Roundcube Webmail; <1.5.8; >=1.6, <1.6.8;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

More information:

  • CVE-2024-42008 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 5. 8. 2024.

Roundcube - information leak (CVE-2024-42010)
CVSS 7.5 (High)

An unauthenticated remote attacker can gain unauthorized access to information by sending an e-mail with a specially crafted CSS file. More information about the vulnerability can be found at [5].

The vulnerability is present in product:

  • Roundcube Webmail; <1.5.8; >=1.6, <1.6.8;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 5. 8. 2024.

By CESNET, z.s.p.o. Martin Krajči on 4. 9. 2024.

CESNET, z.s.p.o. Logo