PT-2018-13128 · Bloop · Bloop Airmail 3

Publicado 2018-08-21 · Atualizado 2020-08-24 · CVE-2018-15667

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Bloop Airmail 3 version 3.5.9

Description An issue in Bloop Airmail 3 allows external applications to send arbitrary emails from an active account without authentication, using the airmail:// URL scheme. The send command in this scheme can be invoked by any method, such as a hyperlink in an email, and processes the command without prompting the user, leading to automatic transmission of attacker-crafted emails.

Recommendations For Bloop Airmail 3 version 3.5.9, consider disabling the airmail:// URL scheme handler until a patch is available to prevent unauthorized email sending. Restrict access to the send command in the URL scheme to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2018-15667

Produtos afetados

Bloop Airmail 3

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-15667 · Aviso do Fabricante
• https://versprite.com/advisories/airmail-3-for-mac · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-15667 · Nota de Segurança