CVE-2024-57004

Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session.

Score

CVSS 3.1 6.1 Medium

Status

Analyzed - cve@mitre.org

Published

2025-02-03

Last modified

2025-02-12

Weaknesses

CWE-80

Affected products

• Webmail (Roundcube)

References

• https://github.com/riya98241/CVE/blob/main/CVE-2024-57004
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.9