Cross-site scripting in Roundcube Webmail - CVE-2024-42009
Published: August 5, 2024 / Updated: June 13, 2025
Vulnerability identifier: #VU95292
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2024-42009
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists in post-processing of sanitized HTML content. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Affected software
Roundcube Webmail
Debian Linux
Fedora
Ubuntu
roundcube (Debian package)
roundcubemail
roundcube (Ubuntu package)
Debian Linux
Fedora
Ubuntu
roundcube (Debian package)
roundcubemail
roundcube (Ubuntu package)
How to mitigate CVE-2024-42009
Install updates from vendor's website.
Roundcube Webmail - addressed in versions 1.5.8, 1.6.8
roundcube (Debian package) - addressed in versions 1.4.15+dfsg.1-1+deb11u4, 1.6.5+dfsg-1+deb12u3
roundcubemail - addressed in versions 1.5.8-1.el9, 1.6.8-1.fc39, 1.6.8-1.fc40
roundcube (Ubuntu package) - update to 1.6.6+dfsg-2ubuntu0.1+esm1
roundcube (Debian package) - addressed in versions 1.4.15+dfsg.1-1+deb11u4, 1.6.5+dfsg-1+deb12u3
roundcubemail - addressed in versions 1.5.8-1.el9, 1.6.8-1.fc39, 1.6.8-1.fc40
roundcube (Ubuntu package) - update to 1.6.6+dfsg-2ubuntu0.1+esm1
Links to Public Exploits and PoC-codes
- Exploit #11622 - CVE-2024-42009-PoC (June 13, 2025)
- Exploit #11165 - CVE-2024-42009 (This Proof of Concept (PoC) demonstrates an exploit for CVE-2024-42009, leveraging a cross-site scripting (XSS) vulnerability to extract emails from a target webmail application. The attack injects a malicious payload that exfiltrates emai (February 21, 2025)
- Exploit #11133 - CVE-2024-42009 (February 12, 2025)
- Exploit #11132 - exploit_CVE-2024-42009 (This script exploits a stored XSS vulnerability (CVE-2024-42009) in Roundcube Webmail version 1.6.7. It injects a malicious payload into the webmail system, which, when triggered, exfiltrates email content from the victim’s inbox.) (February 12, 2025)