CVE-2024-42010

mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42010.json"
}

References

Affected packages

Git / github.com/roundcube/roundcubemail

Affected ranges

Type

GIT

Repo

https://github.com/roundcube/roundcubemail

Events

Introduced

Last Affected

545365ccf7fb87d23015b92a3d96dde58f5ce984

Introduced

993b888afe29c383bf45c84f17090f4db96367ba

Fixed

ed988390312e0ad16843dbd1eb7a1e82241545d2

Fixed

44ed0d6fb0cefe30c9c7892c61c34a21a7213c56

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "1.5.7"
                }
            ],
            "source": "DESCRIPTION"
        },
        {
            "range": [
                {
                    "introduced": "1.6.x"
                },
                {
                    "last_affected": "1.6.7"
                }
            ],
            "source": "DESCRIPTION"
        },
        {
            "original_tag": "1.5.8",
            "range": [
                {
                    "fixed": "ed988390312e0ad16843dbd1eb7a1e82241545d2"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "1.6.8",
            "range": [
                {
                    "fixed": "44ed0d6fb0cefe30c9c7892c61c34a21a7213c56"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*

1.1-beta

1.1-rc

1.1.0

1.2-beta

1.2-rc

1.3-beta

1.4-beta

1.4-rc1

1.4-rc2

1.5-beta

1.5-rc

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

v0.*

v0.1-beta2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42010.json"