CVE-2024-57004
NoneCVSS
—
EPSS
39.7%
Published
Feb 3, 2025
CISA due date
—
The record
Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | roundcube | 0 | No fix |
| Debian:12 | roundcube | 0 | No fix |
| Debian:13 | roundcube | 0 | No fix |
Related vulnerabilities
- CVE-2025-49113 Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by… Also affects roundcube
- CVE-2024-42010 mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters… Also affects roundcube
- CVE-2017-16651 Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows… Also affects roundcube
- CVE-2015-8770 Directory traversal vulnerability in the set_skin function in… Also affects roundcube
- CVE-2008-5619 html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10… Also affects roundcube