CVE-2023-46116criticalCWE-20

CVE-2023-46116: falha crítica em tutao tutanota

Remote Code Execution via insufficiently sanitized call to shell.openExternal

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar tutanota

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 1.3%
Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it correctly blocks the `file:` URL scheme, which can be used by malicious actors to gain code execution on a victims computer, however fails to check other harmful schemes such as `ftp:`, `smb:`, etc. which can also be used. Successful exploitation of this vulnerability will enable an attacker to gain code execution on a victim's computer. Version 3.118.2 contains a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Produtos afetados
tutao · tutanota
CVEs relacionadas — tutao tutanota

No mesmo produto, das mais perigosas para as menos.

CVE-2024-23655HIGHAttacker can prevent users from accessing received emailsEPSS 0.8%CVE-2024-23330MEDIUMTuta loads images from external resourcesEPSS 0.5%