PT-2024-19812 · Tuta · Tuta

79Vt9V4 · Published 2024-01-23 · Updated 2024-02-01 · CVE-2024-23330

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tuta versions prior to 119.10

Description The issue concerns the loading of external content in emails. In the default setting, external resources should not be loaded without user confirmation. However, certain embedded images can be loaded even when the "Automatic Reloading of Images" function is disabled, and this loading occurs unencrypted via HTTP, with the service following redirections. This behavior poses a risk as it allows the sender to determine that the email address is in use, when the email was read, the device used, and exposes the user's IP address.

Recommendations For versions prior to 119.10, update to version 119.10 to resolve the issue. As a temporary workaround, consider disabling the automatic loading of images in the email service settings to minimize the risk of exploitation. Restrict access to external content in emails to prevent unintended loading of resources. Avoid using the default setting that allows automatic reloading of images until the issue is resolved.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-23330

GHSA-32W8-V5FC-VPP7

Affected Products

Tuta

References · 5

• 🔥 https://github.com/tutao/tutanota/security/advisories/GHSA-32w8-v5fc-vpp7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23330.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-23330 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23330 · Security Note
• https://twitter.com/CVEnew/status/1749846965943157164 · Twitter Post