CVE entry · CVE-2024-42009
CVE-2024-42009: RoundCube Webmail Cross-Site Scripting Vulnerability
RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
- Actively exploited: added to CISA’s KEV catalog on June 9, 2025.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: June 30, 2025.
- CERT-FR alert CERTFR-2024-ALE-010 of August 9, 2024.
Description from CISA’s KEV catalog.
CERT-FR alerts and notices
-
CERTFR-2024-ALE-010Multiples vulnérabilités dans Roundcube (09 août 2024)
What to do
- Check whether your estate includes Roundcube Webmail, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.