Security readout for executives and security teams
Plain-English summary
This flaw lets an attacker send a specially crafted email that can run script in a victim’s Roundcube Webmail session. If the victim opens the message, the attacker may steal or send emails as that user. CISA lists it as known exploited, so exposed Roundcube systems need urgent attention.
Executive priority
Emergency patching is warranted where Roundcube is exposed or used for sensitive mail. The business risk is mailbox compromise, email theft, and unauthorized sending from trusted accounts, with active exploitation confirmed by KEV.
Technical view
CVE-2024-42009 is a CWE-79 cross-site scripting issue in Roundcube message_body() in program/actions/mail/show.php. Roundcube through 1.5.7 and 1.6.x through 1.6.7 are described as affected. CVSS 3.1 is 9.3, with network attack vector, low complexity, no privileges, and required user interaction.
Likely exposure
Organizations running Roundcube Webmail through 1.5.7 or 1.6.x through 1.6.7, especially internet-facing webmail portals. The attack requires a victim to view a crafted email, but no attacker account is required according to the CVSS vector.
Exploitation context
Active exploitation is supported by the CISA KEV listing. The provided source bundle does not establish campaign scale, specific threat actors, or public exploit availability. SonarSource’s advisory frames the issue as high risk for government email environments.
Researcher notes
The source bundle’s affected product table is incomplete, but the CVE description and Roundcube release references identify affected Roundcube version ranges. Avoid assuming additional products or forks are affected without vendor evidence. Validation should focus on version state and mailbox abuse indicators, not exploit reproduction.
Mitigation direction
- Upgrade Roundcube 1.6.x deployments to 1.6.8 or later.
- Upgrade Roundcube 1.5.x deployments to 1.5.8 or later.
- Prioritize externally reachable webmail systems and high-value mailboxes.
- Review vendor guidance before applying compensating controls.
- Increase monitoring for suspicious email access or sending patterns.
Validation and detection
- Inventory all Roundcube Webmail instances and record exact versions.
- Confirm no deployment remains on versions through 1.5.7 or 1.6.7.
- Verify the deployed package matches the vendor security release.
- Review mail logs for unusual sending activity after message views.
- Check incident response queues for related user mailbox alerts.
Public sources used
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-42009 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N2.85.8Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.3CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/roundcube/roundcubemail/releasesCVE reference
- https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/CVE reference
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.8CVE reference
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.8CVE reference
- https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8CVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-42009CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.