PT-2025-3376 · Unknown+1 · Roundcube Webmail+1

Riya Agrawal · Published 2025-02-03 · Updated 2025-12-22 · CVE-2024-57004

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Roundcube Webmail version 1.6.9

Description The issue allows remote authenticated users to upload a malicious file as an email attachment. This leads to the triggering of a Cross-Site Scripting (XSS) attack when the SENT session is visited.

Recommendations For Roundcube Webmail version 1.6.9, consider disabling the file upload feature for email attachments until a patch is available. Restrict access to the SENT session to minimize the risk of exploitation. Avoid using the email attachment feature in the affected version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2024-57004

Affected Products

Debian

Roundcube Webmail

References · 11

• 🔥 https://github.com/riya98241/CVE/blob/main/CVE-2024-57004 · Exploit
• https://osv.dev/vulnerability/CVE-2024-57004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57004 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-57004 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-57004 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-57004 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-57004 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-57004 · Vendor Advisory
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.9 · Note
• https://twitter.com/CVEnew/status/1886499094295928908 · Twitter Post
• https://t.me/cveNotify/146538 · Telegram Post