CVE-2020-11879 Path traversal in n/a

What is CVE-2020-11879?

CVE-2020-11879 is a medium-severity path traversal vulnerability in n/a, published on 17 Apr 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.

Which versions are affected by CVE-2020-11879?

It affects 1 product.

Products include Gnome Evolution.

How do I fix CVE-2020-11879?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2020-11879 being exploited?

There is no known exploitation of CVE-2020-11879 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-12422 Memory corruption in n/a Critical 9.8
• CVE-2008-1109 Memory corruption in n/a Critical 9.3
• CVE-2009-3721 Path traversal in ytnef High 7.8
• CVE-2008-1108 Memory corruption in n/a High 7.6
• CVE-2013-4166 Information disclosure in Evolution High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2020-11879, GHSA-c29m-85fj-ccfm, SUSE-SU-2023:3375-1, UBUNTU-CVE-2020-11879.