9.3

CVE-2023-46116

Exploit

Remote Code Execution via insufficiently sanitized call to shell.openExternal

Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it correctly blocks the `file:` URL scheme, which can be used by malicious actors to gain code execution on a victims computer, however fails to check other harmful schemes such as `ftp:`, `smb:`, etc. which can also be used. Successful exploitation of this vulnerability will enable an attacker to gain code execution on a victim's computer. Version 3.118.2 contains a patch for this issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tuta ≫ Tutanota SwPlatformnode.js Version < 3.118.12
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.26% 0.657
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
security-advisories@github.com 9.3 2.8 5.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L417
Product
https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L423
Product
https://github.com/tutao/tutanota/commit/88ecad17d00d05a722399aed35f0d280899d55a2
Patch
https://github.com/tutao/tutanota/security/advisories/GHSA-mxgj-pq62-f644
Vendor Advisory
Exploit
https://user-images.githubusercontent.com/46137338/270564886-7a0389d3-f9ef-44e1-9f5e-57ccc72dcaa8.mp4
Exploit