CVE-2024-42010: Infoleak
modcssstyles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42010?
CVE-2024-42010 is considered a critical vulnerability due to its capability to expose sensitive information.
How do I fix CVE-2024-42010?
To mitigate CVE-2024-42010, upgrade Roundcube to version 1.5.8 or later, as this version addresses the vulnerability.
What impact does CVE-2024-42010 have on Roundcube users?
CVE-2024-42010 allows remote attackers to exploit insufficient filtering of CSS tokens in email messages, potentially leading to data exposure.
Which versions of Roundcube are affected by CVE-2024-42010?
CVE-2024-42010 affects Roundcube versions from 1.5.7 and 1.6.x up to 1.6.7.
Can CVE-2024-42010 be exploited remotely?
Yes, CVE-2024-42010 can be exploited remotely by attackers through crafted email messages.