Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-p4jr-wm76-h2v3

Опубликовано: 19 нояб. 2022
Источник: github
Github: Не прошло ревью
CVSS3: 7.4

Описание

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

EPSS

Процентиль: 12%
0.0004
Низкий

7.4 High

CVSS3

Дефекты

CWE-146

Связанные уязвимости

CVSS3: 7.4
ubuntu
больше 3 лет назад

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

CVSS3: 7.4
redhat
больше 3 лет назад

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

CVSS3: 7.4
nvd
больше 3 лет назад

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

CVSS3: 7.4
msrc
около 1 года назад

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

CVSS3: 7.4
debian
больше 3 лет назад

When xdg-mail is configured to use thunderbird for mailto URLs, improp ...

EPSS

Процентиль: 12%
0.0004
Низкий

7.4 High

CVSS3

Дефекты

CWE-146