CVE-2021-29969

Katalog CVE

CVSS 5.9 · Medium EPSS 1,2%

Kerentanan Files or Directories Accessible to External Parties pada mozilla thunderbird. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data. This could have resulted in Thunderbird showing incorrect information, for example the attacker could have tricked Thunderbird to show folders that didn't exist on the IMAP server. This vulnerability affects Thunderbird < 78.12.

Rincian

Terbit di NVD

5 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.mozilla.org/show_bug.cgi?id=1682370 issue tracking · permissions required · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2021-30/ advisory vendor
• https://security.gentoo.org/glsa/202208-14 advisory pihak ketiga