CVE-2023-46116
CVSS V2 None
CVSS V3 None
Description
Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it correctly blocks the `file:` URL scheme, which can be used by malicious actors to gain code execution on a victims computer, however fails to check other harmful schemes such as `ftp:`, `smb:`, etc. which can also be used. Successful exploitation of this vulnerability will enable an attacker to gain code execution on a victim's computer. Version 3.118.2 contains a patch for this issue.
Overview
- CVE ID
- CVE-2023-46116
- Assigner
- GitHub_M
- Vulnerability Status
- PUBLISHED
- Published Version
- 2023-12-15T13:44:05.153Z
- Last Modified Date
- 2023-12-15T13:44:05.153Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/tutao/tutanota/security/advisories/GHSA-mxgj-pq62-f644 | x_refsource_CONFIRM |
| https://github.com/tutao/tutanota/commit/88ecad17d00d05a722399aed35f0d280899d55a2 | x_refsource_MISC |
| https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L417 | x_refsource_MISC |
| https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L423 | x_refsource_MISC |
| https://user-images.githubusercontent.com/46137338/270564886-7a0389d3-f9ef-44e1-9f5e-57ccc72dcaa8.mp4 | x_refsource_MISC |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-46116 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46116 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-06-24 22:31:53 | Added to TrackCVE |