Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-rg69-33g2-mp48

Опубликовано: 14 мая 2025
Источник: github
Github: Не прошло ревью
CVSS3: 7.5

Описание

Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actual address. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1.

Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actual address. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1.

EPSS

Процентиль: 17%
0.00053
Низкий

7.5 High

CVSS3

Дефекты

CWE-290

Связанные уязвимости

CVSS3: 7.5
ubuntu
около 1 месяца назад

Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actual address. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1.

CVSS3: 7.5
redhat
около 1 месяца назад

Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actual address. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1.

CVSS3: 7.5
nvd
около 1 месяца назад

Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actual address. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1.

CVSS3: 7.5
debian
около 1 месяца назад

Thunderbird parses addresses in a way that can allow sender spoofing i ...

CVSS3: 7.5
fstec
4 месяца назад

Уязвимость почтового клиента Thunderbird, связанная с некорректной обработкой заголовка p2-from, позволяющая нарушителю проводить спуфинг атаки

EPSS

Процентиль: 17%
0.00053
Низкий

7.5 High

CVSS3

Дефекты

CWE-290