A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

A China-aligned threat cluster, UNK_MassTraction, has been linked to exploitation of known Roundcube vulnerabilities. Apply the available patches as soon as possible.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0466 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-49113:
    Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated     users because the _from parameter in a URL is not validated in program/actions/settings/upload.php,     leading to PHP Object Deserialization.

    CVE-2024-42009:
    A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote     attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization     issue in message_body() in program/actions/mail/show.php.

    CVE-2024-42008:
    A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x     through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail     attachment served with a dangerous Content-Type header.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7636-1 advisory.

    It was discovered that Roundcube Webmail incorrectly handled sanitization in the message_body function. A     remote attacker could possibly use this issue to send and receive emails as another user.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, Roundcube Webmail is prior to 1.5.8 or 1.6.x prior to 1.6.8. Therefore, it may be affected by multiple vulnerabilities :

- A Cross-Site Scripting (XSS) in rcmail_action_mail_get->run().

- A Cross-Site Scripting (XSS) via a crafted e-mail message that abuses a desanitization issue in message_body() in program/actions/mail/show.php.

- An Exposure of Sensitive Information through insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0328-1 advisory.

    Update to 1.6.8     This is a security update to the stable version 1.6 of Roundcube Webmail.
    It provides fixes to recently reported security vulnerabilities:

      * Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
      * Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
      * Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]

      CHANGELOG

      * Managesieve: Protect special scripts in managesieve_kolab_master mode
      * Fix newmail_notifier notification focus in Chrome (#9467)
      * Fix fatal error when parsing some TNEF attachments (#9462)
      * Fix double scrollbar when composing a mail with many plain text lines (#7760)
      * Fix decoding mail parts with multiple base64-encoded text blocks (#9290)
      * Fix bug where some messages could get malformed in an import from a MBOX file (#9510)
      * Fix invalid line break characters in multi-line text in Sieve scripts (#9543)
      * Fix bug where 'with attachment' filter could fail on some fts engines (#9514)
      * Fix bug where an unhandled exception was caused by an invalid image attachment (#9475)
      * Fix bug where a long subject title could not be displayed in some cases (#9416)
      * Fix infinite loop when parsing malformed Sieve script (#9562)
      * Fix bug where imap_conn_option's 'socket' was ignored (#9566)
      * Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
      * Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
      * Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b60eb661a4 advisory.

    **Version 1.6.8**

    - Managesieve: Protect special scripts in managesieve_kolab_master mode
    - Fix newmail_notifier notification focus in Chrome (#9467)
    - Fix fatal error when parsing some TNEF attachments (#9462)
    - Fix double scrollbar when composing a mail with many plain text lines (#7760)
    - Fix decoding mail parts with multiple base64-encoded text blocks (#9290)
    - Fix bug where some messages could get malformed in an import from a MBOX file (#9510)
    - Fix invalid line break characters in multi-line text in Sieve scripts (#9543)
    - Fix bug where with attachment filter could fail on some fts engines (#9514)
    - Fix bug where an unhandled exception was caused by an invalid image attachment (#9475)
    - Fix bug where a long subject title could not be displayed in some cases (#9416)
    - Fix infinite loop when parsing malformed Sieve script (#9562)
    - Fix bug where imap_conn_option's 'socket' was ignored (#9566)
    - Fix XSS vulnerability in post-processing of sanitized HTML content **CVE-2024-42009**
    - Fix XSS vulnerability in serving of attachments other than HTML or SVG **CVE-2024-42008**
    - Fix information leak (access to remote content) via insufficient CSS filtering **CVE-2024-42010**




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-2e908e829a advisory.

    **Version 1.6.8**

    - Managesieve: Protect special scripts in managesieve_kolab_master mode
    - Fix newmail_notifier notification focus in Chrome (#9467)
    - Fix fatal error when parsing some TNEF attachments (#9462)
    - Fix double scrollbar when composing a mail with many plain text lines (#7760)
    - Fix decoding mail parts with multiple base64-encoded text blocks (#9290)
    - Fix bug where some messages could get malformed in an import from a MBOX file (#9510)
    - Fix invalid line break characters in multi-line text in Sieve scripts (#9543)
    - Fix bug where with attachment filter could fail on some fts engines (#9514)
    - Fix bug where an unhandled exception was caused by an invalid image attachment (#9475)
    - Fix bug where a long subject title could not be displayed in some cases (#9416)
    - Fix infinite loop when parsing malformed Sieve script (#9562)
    - Fix bug where imap_conn_option's 'socket' was ignored (#9566)
    - Fix XSS vulnerability in post-processing of sanitized HTML content **CVE-2024-42009**
    - Fix XSS vulnerability in serving of attachments other than HTML or SVG **CVE-2024-42008**
    - Fix information leak (access to remote content) via insufficient CSS filtering **CVE-2024-42010**




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 5776cc4f-5717-11ef-b611-84a93843eb75 advisory.

    The Roundcube project reports:
    XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]     XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]     information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote web server is running Roundcube Webmail version 1.5.x prior to 1.5.8 or 1.6.x prior to 1.6.8. It is, therefore, affected by multiple vulnerabilities.

  - A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x   through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail   attachment served with a dangerous Content-Type header. (CVE-2024-42008)

  - A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote   attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization   issue in message_body() in program/actions/mail/show.php. (CVE-2024-42009)

  - mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a insufficiently filters   Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to   obtain sensitive information. (CVE-2024-42010)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5743 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5743-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     August 08, 2024                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : roundcube     CVE ID         : CVE-2024-42008 CVE-2024-42009 CVE-2024-42010

    Multiple cross-site scripting vulnerabilities were discovered in     RoundCube webmail.

    For the stable distribution (bookworm), these problems have been fixed in     version 1.6.5+dfsg-1+deb12u3.

    We recommend that you upgrade your roundcube packages.

    For the detailed security status of roundcube please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/roundcube

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
275923	TencentOS Server 4: roundcubemail (TSSA-2025:0466)	Nessus	Tencent Local Security Checks	Local	critical
242199	Ubuntu 24.04 LTS : Roundcube Webmail vulnerability (USN-7636-1)	Nessus	Ubuntu Local Security Checks	Local	critical
114555	Roundcube Webmail 1.6.x < 1.6.8 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
114554	Roundcube Webmail 1.5.x < 1.5.8 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
208677	openSUSE 15 Security Update : roundcubemail (openSUSE-SU-2024:0328-1)	Nessus	SuSE Local Security Checks	Local	critical
205626	Fedora 39 : roundcubemail (2024-b60eb661a4)	Nessus	Fedora Local Security Checks	Local	critical
205574	Fedora 40 : roundcubemail (2024-2e908e829a)	Nessus	Fedora Local Security Checks	Local	critical
205349	FreeBSD : Roundcube -- Multiple vulnerabilities (5776cc4f-5717-11ef-b611-84a93843eb75)	Nessus	FreeBSD Local Security Checks	Local	critical
205297	Roundcube Webmail 1.5.x < 1.5.8 / 1.6.x < 1.6.8 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	critical
205191	Debian dsa-5743 : roundcube - security update	Nessus	Debian Local Security Checks	Local	critical

Detections

Analytics

CVE-2024-42009

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical