Description

A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.

Remediation

References

CVE-2024-42008

Related Vulnerabilities

WordPress Plugin Dynamic Featured Image Unspecified Vulnerability (1.0.3)

WordPress Plugin Zeno Font Resizer Cross-Site Scripting (1.7.9)

WordPress Plugin Side Menu Lite-add sticky fixed buttons SQL Injection (2.2)

MySQL CVE-2023-21972 Vulnerability (CVE-2023-21972)

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions Cross-Site Scripting (2.6.5)

Severity

Critical

Classification

CVE-2024-42008 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Tags

Missing Update Known Vulnerabilities