CVE-2020-27748 Information disclosure in xdg-utils
Attackers can craft mailto URIs to silently attach sensitive files to emails in Thunderbird, leading to data disclosure if the user sends the email.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-27748?
CVE-2020-27748 is a medium-severity vulnerability in xdg-utils, published on 1 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.
Weakness: CWE-201
Which versions are affected by CVE-2020-27748?
It affects 1 product.
Products include Freedesktop Xdg-Utils.
How do I fix CVE-2020-27748?
Apply the vendor's patch.
Is CVE-2020-27748 being exploited?
There is no known exploitation of CVE-2020-27748 in the wild and no public exploit code.
Other vulnerabilities in xdg-utils
Sources
Also known as AZL-37062, AZL-7424, DEBIAN-CVE-2020-27748, GHSA-3c8x-jg6w-85xx, MGASA-2020-0446, OESA-2021-1228 and 4 more.