Information disclosure in Roundcube Webmail - CVE-2024-42010

Vulnerability identifier: #VU95308

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-42010

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application within insufficient CSS filtering. A remote attacker can gain unauthorized access to sensitive information on the system.

Roundcube Webmail
Debian Linux
Fedora
Ubuntu
roundcube (Ubuntu package)
roundcube (Debian package)
roundcubemail

Install updates from vendor's website.

Roundcube Webmail - addressed in versions 1.5.8, 1.6.8
roundcube (Ubuntu package) - addressed in versions 1.2~beta+dfsg.1-0ubuntu1+esm8, 1.3.6+dfsg.1-1ubuntu0.1~esm8, 1.4.3+dfsg.1-1ubuntu0.1~esm8, 1.5.0+dfsg.1-2ubuntu0.1~esm6, 1.6.6+dfsg-2ubuntu0.1+esm3
roundcube (Debian package) - addressed in versions 1.4.15+dfsg.1-1+deb11u4, 1.6.5+dfsg-1+deb12u3
roundcubemail - addressed in versions 1.5.8-1.el9, 1.6.8-1.fc39, 1.6.8-1.fc40

• Exploit #11302 - Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC (April 11, 2025)

• https://github.com/roundcube/roundcubemail/releases/tag/1.6.8
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.8

• Multiple vulnerabilities in Roundcube
• Fedora EPEL 9 update for roundcubemail
• Fedora 39 update for roundcubemail
• Fedora 40 update for roundcubemail
• Debian update for roundcube
• Debian update for roundcube
• Ubuntu update for roundcube