PT-2018-13129 · Bloop · Bloop Airmail 3

Publicado 2018-08-21 · Atualizado 2020-05-11 · CVE-2018-15668

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bloop Airmail 3 version 3.5.9

Description An issue in the "send" command of the airmail:// URL scheme allows external applications to send arbitrary emails from an active account without user prompt. The command accepts URL parameters with the "attachment " prefix to designate attachment parameters. If the value of an attachment parameter matches an accessible file path, the file is attached to the outbound message. Relative file paths are also acceptable as attachment parameter values. This can be invoked through methods like hyperlinks in emails, leading to automatic email transmission with designated attachments.

Recommendations For Bloop Airmail 3 version 3.5.9, consider disabling the "send" command in the airmail:// URL scheme until a patch is available to prevent unauthorized email transmissions. Restrict access to the attachment parameters with the "attachment " prefix to minimize the risk of exploitation. Avoid using relative file paths as attachment parameter values to reduce the attack surface.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-15668

Produtos afetados

Bloop Airmail 3

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-15668 · Nota de Segurança
• https://versprite.com/advisories/airmail-3-for-mac-2 · Nota
• https://osv.dev/vulnerability/CVE-2018-15668 · Aviso do Fabricante