CVE-2025-3523

Katalog CVE

CVSS 6.4 · Medium EPSS 0,31%

Kerentanan User Interface (UI) Misrepresentation of Critical Information pada mozilla thunderbird. Skor CVSS 3.1 6.4 (Medium) menurut CISA ADP.

Deskripsi (NVD)

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.

Rincian

Terbit di NVD

15 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.4 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-451: User Interface (UI) Misrepresentation of Critical Information

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mozilla.org/security/advisories/mfsa2025-26/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2025-27/ advisory vendor
• https://bugzilla.mozilla.org/show_bug.cgi?id=1958385 permissions required