Detections
Analytics

CVE-2024-42009

critical

Description

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

References

https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/

https://www.theregister.com/security/2026/07/08/suspected-chinese-snoops-caught-breaking-into-universities-roundcube-mailservers/5268778

https://www.bleepingcomputer.com/news/security/hackers-exploit-roundcube-flaw-to-spy-on-academic-researchers/

https://hackread.com/unk-masstraction-roundcube-us-canada-universities/

https://www.proofpoint.com/us/blog/threat-insight/one-email-closer-edge-unkmasstraction-physics-exploitation

https://www.infosecurity-magazine.com/news/china-aligned-cluster-roundcube/

https://www.databreachtoday.com/chinese-cyberespionage-exploits-university-roundcube-servers-a-32165

https://thehackernews.com/2026/07/suspected-china-aligned-hackers-exploit.html

https://cyberscoop.com/china-espionage-attacks-us-canada-universities-proofpoint/

https://thehackernews.com/2026/05/ghostwriter-targets-ukrainian.html

https://www.securityweek.com/exploited-vulnerability-impacts-over-80000-roundcube-servers/

https://www.darkreading.com/application-security/poc-code-escalates-roundcube-vuln-threat

https://thehackernews.com/2025/06/cisa-adds-erlang-ssh-and-roundcube.html

https://securityaffairs.com/178843/hacking/u-s-cisa-adds-roundcube-erlang-erlang-flaws-known-exploited-vulnerabilities-catalog.html

https://www.cisa.gov/news-events/alerts/2025/06/09/cisa-adds-two-known-exploited-vulnerabilities-catalog

https://www.helpnetsecurity.com/2025/06/09/roundcube-rce-dark-web-activity-signals-imminent-attacks-cve-2025-49113/

https://www.helpnetsecurity.com/2024/08/07/cve-2024-42009-cve-2024-42008/

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-42009

https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8

https://github.com/roundcube/roundcubemail/releases/tag/1.6.8

https://github.com/roundcube/roundcubemail/releases/tag/1.5.8

https://github.com/roundcube/roundcubemail/releases

Details

Source: Mitre, NVD

Published: 2024-08-05

Updated: 2025-11-04

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 9.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

Severity: High

CVSS v3

Base Score: 9.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Severity: Critical

EPSS

EPSS: 0.83387

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest