← Back

CVE-2022-3155

nvd nist
Published: Dec 22, 2022Modified: Apr 15, 2025

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

When saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple.quarantine on the received file. If the received file was an application and the user attempted to open it, then the application was started immediately without asking the user to confirm. This vulnerability affects Thunderbird < 102.3.

Affected (1)

Products: Mozilla: Thunderbird
Mozilla
1 product
Thunderbird
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Thunderbird
Before 102.3
Running on/withPlatform Versions
Apple
Macos
All versions

Related CWEs

CWE-276
Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.

References (5)

Source: security@mozilla.org
Issue TrackingPermissions RequiredVendor Advisory
Source: security@mozilla.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPermissions RequiredVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Issue TrackingPermissions RequiredVendor Advisory

Timeline

No history available yet.