A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
Is CVE-2024-42009 exploited?
Listed in the CISA KEV catalog on 2025-06-09.
Federal remediation due 2025-06-30.
Past that date by 411 days.
EPSS puts exploitation in the next 30 days at 80%.
Public exploit code: none found in monitored sources.
Public detection rules exist.
Which products and versions are affected?
No affected package list recorded here yet.
Is there a patch?
No patch identifier recorded here yet.
What PlainSec published about CVE-2024-42009
PlainSec has not published a story about this CVE.