PT-2025-16352 · Mozilla+11 · Thunderbird+11
Dario Weißer
·
Published
2025-04-15
·
Updated
2025-07-22
·
CVE-2025-3522
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Thunderbird versions prior to 137.0.2
Thunderbird versions prior to 128.9.2
Description
The issue arises from Thunderbird's handling of the X-Mozilla-External-Attachment-URL header, which allows for external attachments. When an email is opened, Thunderbird accesses the specified URL to determine file size and navigates to it when the user clicks the attachment. Since the URL is not validated or sanitized, it can reference internal resources like
chrome:// or SMB share file:// links. This potentially leads to hashed Windows credential leakage and opens the door to more serious security issues.Recommendations
For versions prior to 137.0.2, update to version 137.0.2 or later.
For versions prior to 128.9.2, update to version 128.9.2 or later.
As a temporary workaround, consider restricting access to external attachments until a patch is applied.
Fix
Open Redirect
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Thunderbird
Ubuntu