CVE-2024-1936

Katalog CVE

CVSS 7.5 · High EPSS 0,68%

Kerentanan Insecure Storage of Sensitive Information pada mozilla thunderbird, debian linux. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third-party. While this update fixes the bug and avoids future message contamination, it does not automatically repair existing contaminations. Users are advised to use the repair folder functionality, which is available from the context menu of email folders, which will erase incorrect subject assignments. This vulnerability affects Thunderbird < 115.8.1.

Rincian

Terbit di NVD

4 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-922: Insecure Storage of Sensitive Information

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 51,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.mozilla.org/show_bug.cgi?id=1860977 exploit · issue tracking · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2024-11/ advisory vendor
• https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html mailing list