CVE-2024-42010

7.5 HIGH

Published: August 05, 2024 Modified: April 15, 2026

Description

mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://github.com/roundcube/roundcubemail/releases

Source: cve@mitre.org

https://github.com/roundcube/roundcubemail/releases/tag/1.5.8

Source: cve@mitre.org

https://github.com/roundcube/roundcubemail/releases/tag/1.6.8

Source: cve@mitre.org

https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8

Source: cve@mitre.org

https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/

Source: cve@mitre.org

5 reference(s) from NVD

Quick Stats

CVSS v3 Score

7.5 / 10.0

EPSS (Exploit Probability)

14.8%

95th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-200

Related CVEs