Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-4h7q-pj8m-5675

Опубликовано: 15 апр. 2025
Источник: github
Github: Не прошло ревью
CVSS3: 6.4

Описание

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.

EPSS

Процентиль: 16%
0.0005
Низкий

6.4 Medium

CVSS3

Дефекты

CWE-451

Связанные уязвимости

CVSS3: 6.4
ubuntu
2 месяца назад

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.

CVSS3: 6.4
redhat
2 месяца назад

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.

CVSS3: 6.4
nvd
2 месяца назад

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.

CVSS3: 6.4
debian
2 месяца назад

When an email contains multiple attachments with external links via th ...

suse-cvrf
около 2 месяцев назад

Security update for MozillaThunderbird

EPSS

Процентиль: 16%
0.0005
Низкий

6.4 Medium

CVSS3

Дефекты

CWE-451