CVE-2022-4055
 
Severity Score
7.4
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.
Cuando xdg-mail está configurado para usar Thunderbird para URL de correo, el análisis incorrecto de la URL puede provocar que se pasen encabezados adicionales a Thunderbird que no deberían incluirse según RFC 2368. Un atacante puede usar este método para crear una URL de correo que parezca segura a los usuarios, pero en realidad adjuntará archivos cuando se haga clic en ellos.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-11-17 CVE Reserved
- 2022-11-18 CVE Published
- 2024-06-10 EPSS Updated
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-146: Improper Neutralization of Expression/Command Delimiters
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/205#note_1494267 | 2024-08-03 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Freedesktop Search vendor "Freedesktop" | Xdg-utils Search vendor "Freedesktop" for product "Xdg-utils" | >= 1.1.0 <= 1.1.3 Search vendor "Freedesktop" for product "Xdg-utils" and version " >= 1.1.0 <= 1.1.3" | - |
Affected
|