CVE-2020-27748

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.
References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1899769 Issue Tracking Third Party Advisory
https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/177 Exploit Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:freedesktop:xdg-utils:*:*:*:*:*:*:*:*

History

11 Jun 2021, 17:34

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : 4.3
v3 : 6.5
CPE cpe:2.3:a:freedesktop:xdg-utils:*:*:*:*:*:*:*:*
CWE CWE-201
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1899769 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1899769 - Issue Tracking, Third Party Advisory
References (MISC) https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/177 - (MISC) https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/177 - Exploit, Issue Tracking, Vendor Advisory

01 Jun 2021, 14:15

Type Values Removed Values Added
New CVE

Information

Published : 2021-06-01 14:15

Updated : 2024-02-04 21:47


NVD link : CVE-2020-27748

Mitre link : CVE-2020-27748

CVE.ORG link : CVE-2020-27748


JSON object : View

Products Affected

freedesktop

  • xdg-utils
CWE
CWE-201

Insertion of Sensitive Information Into Sent Data