« Volver al listado

CVE-2024-42010

Estado: AplazadaAlta (7.5)—

mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Roundcube — RoundcubeAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-42010",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-42010",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-06T14:03:28.723587Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:roundcube:roundcube:*:*:*:*:*:*:*:*"
          ],
          "vendor": "roundcube",
          "product": "roundcube",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "1.5.7"
            },
            {
              "status": "affected",
              "version": "1.6x",
              "versionType": "custom",
              "lessThanOrEqual": "1.6.7"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-05T19:15:38.273",
  "references": [
    {
      "url": "https://github.com/roundcube/roundcubemail/releases",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.8",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.8",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information."
    },
    {
      "lang": "es",
      "value": "mod_css_styles en Roundcube hasta 1.5.7 y 1.6.x hasta 1.6.7 permite filtrar insuficientemente secuencias de tokens de hojas de estilo en cascada (CSS) en mensajes de correo electrónico renderizados, lo que permite a un atacante remoto obtener información confidencial."
    }
  ],
  "lastModified": "2026-06-17T07:48:38.097",
  "sourceIdentifier": "cve@mitre.org"
}