CVE-2022-1520 Security feature bypass in Thunderbird
Thunderbird may incorrectly display encryption or signature status for emails containing attached signed or encrypted messages, potentially misleading users about security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-1520?
CVE-2022-1520 is a medium-severity vulnerability in Mozilla Thunderbird, published on 22 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird < 91.9.
Weakness: CWE-346
Which versions are affected by CVE-2022-1520?
It affects 1 product.
Products include Mozilla Thunderbird.
How do I fix CVE-2022-1520?
Upgrade to a fixed version.
Is CVE-2022-1520 being exploited?
There is no known exploitation of CVE-2022-1520 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Thunderbird
Sources
Also known as DEBIAN-CVE-2022-1520, GHSA-3qrc-jgqf-vg35, UBUNTU-CVE-2022-1520.