PT-2018-5250 · Nylas · Nylas Mail

L2Dyo · Published 2018-01-03 · Updated 2019-10-03 · CVE-2017-1000485

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nylas Mail Lives version 2.2.2

Description The issue allows local users to obtain sensitive authentication information via standard filesystem operations due to the use of 0755 permissions for $HOME/.nylas-mail.

Recommendations For version 2.2.2, consider changing the permissions of $HOME/.nylas-mail to a more restrictive setting to prevent unauthorized access to sensitive authentication information.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-1000485

Affected Products

Nylas Mail

References · 3

• https://osv.dev/vulnerability/CVE-2017-1000485 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000485 · Security Note
• https://github.com/nylas-mail-lives/nylas-mail/issues/181 · Note