CVE-2023-46116

Katalog CVE

CVSS 8.8 · High EPSS 1,3%

Kerentanan Improper Input Validation pada tutanota. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it correctly blocks the `file:` URL scheme, which can be used by malicious actors to gain code execution on a victims computer, however fails to check other harmful schemes such as `ftp:`, `smb:`, etc. which can also be used. Successful exploitation of this vulnerability will enable an attacker to gain code execution on a victim's computer. Version 3.118.2 contains a patch for this issue.

Rincian

Terbit di NVD

15 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 68,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tutao/tutanota/security/advisories/GHSA-mxgj-pq62-f644 exploit · advisory vendor
• https://github.com/tutao/tutanota/commit/88ecad17d00d05a722399aed35f0d280899d55a2 patch
• https://user-images.githubusercontent.com/46137338/270564886-7a0389d3-f9ef-44e1-9f5e-57ccc72dcaa8.mp4 exploit
• https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L417 product
• https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L423 product