VDB
BDU%3A2024-06254
BDU%3A2024-06254
PUBLISHED
CVSS 6.400000095367432 MEDIUM
Уязвимость функции rcmail_action_mail_get->run() почтового клиента RoundCube Webmail, позволяющая нарушителю провести атаку межсайтового скриптинга (XSS)
Risk Scores
CVSS 2.0
6.400000095367432
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Novell Inc., Сообщество свободного программного обеспечения, ООО «Ред Софт», The RoundCube Team | openSUSE Tumbleweed, Debian GNU/Linux, РЕД ОС (запись в едином реестре российских программ №3751), RoundCube Webmail | |
| n/a | n/a | n/a |
Timeline
- Aug 5, 2024 CVE Published
- Aug 5, 2024 PoC Published
- Aug 7, 2024 PoC Published
- Sep 2, 2024 CVE Updated
- Jan 20, 2025 PoC Published
- Feb 13, 2025 PoC Published
- Feb 15, 2025 PoC Published
- Feb 21, 2026 PoC Published
- Jul 12, 2026 PoC Published
- Jul 13, 2026 PoC Published
- Jul 14, 2026 PoC Published
References
- https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8 advisory
- http://repo.red-soft.ru/redos/7.3c/x86_64/updates/ advisory
- https://www.tenable.com/cve/CVE-2024-42008 url
- https://security-tracker.debian.org/tracker/CVE-2024-42008 url
- https://www.sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/ url
- https://itshaman.ru/news/security/uyazvimost-roundcube-pozvolyayut-legko-vzlomat-uchetnye-zapisi-elektronnoi-pochty-cve-2024-42009-cve-2024-42008 url
- https://github.com/roundcube/roundcubemail/releases advisory
- https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/ url
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.8 url
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.8 url
- https://www.suse.com/security/cve/CVE-2024-42008.html advisory