EXPOSURES › CVE-2024-42009

CVE-2024-42009

HIGH ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2025-06-09 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2024-42009 ↗

⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 72/100 exploited-in-wildunpatched

Over 84,000 Roundcube Webmail servers actively exploited for XSS

Roundcube Webmail's cross-site scripting vulnerability allowed attackers to steal and send emails via crafted messages, impacting over 84,000 servers.

Shame score — Massive exposure and active exploitation of a critical vulnerability in a widely-used product.

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

Roundcube · vendor Webmail · product

DESCRIPTION

RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

AFFECTED FEDRAMP PRODUCTS · 0

No correlated FedRAMP products.