CVE-2022-4055CWE-146

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that…

High · published November 18, 2022

CVSS v3.1
7.4
EPSS
1%
Percentile
51.7
In the wild
Unconfirmed
What it is

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00678 · 51.7th percentile
Weakness
CWE-146 · Improper Neutralization of Expression/Command Delimiters
Published
2022-11-18T00:00Z
EPSS history
Timeline
  • 18 NOV 00:00Z
    When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that…
    cvelistv5