CVE-2024-42010: Infoleak
modcssstyles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/roundcubeto a version that resolves this vulnerability.Fixed in 1.6.5+dfsg-1+deb12u3 - Upgrade
Upgrade
debian/roundcubeto a version that resolves this vulnerability.Fixed in 1.6.8+dfsg-1 - Upgrade
Upgrade
debian/roundcubeto a version that resolves this vulnerability.Fixed in 1.6.5+dfsg-1+deb12u9Fixed in 1.6.5+dfsg-1+deb12u12Fixed in 1.6.18+dfsg-0+deb13u1Fixed in 1.6.20+dfsg-0+deb13u1Fixed in 1.6.20+dfsg-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42010?
CVE-2024-42010 is considered a critical vulnerability due to its capability to expose sensitive information.
How do I fix CVE-2024-42010?
To mitigate CVE-2024-42010, upgrade Roundcube to version 1.5.8 or later, as this version addresses the vulnerability.
What impact does CVE-2024-42010 have on Roundcube users?
CVE-2024-42010 allows remote attackers to exploit insufficient filtering of CSS tokens in email messages, potentially leading to data exposure.
Which versions of Roundcube are affected by CVE-2024-42010?
CVE-2024-42010 affects Roundcube versions from 1.5.7 and 1.6.x up to 1.6.7.
Can CVE-2024-42010 be exploited remotely?
Yes, CVE-2024-42010 can be exploited remotely by attackers through crafted email messages.