CVE-2023-3417 — Unrestricted File Upload in Mozilla Thunderbird

CWE-434 — Unrestricted File Upload10 documents8 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 56.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla ThunderbirdDebian Linux
Timeline
PublishedJul 24
Latest updateSep 4

Description

Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird < 115.0.1 and Thunderbird < 102.13.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5mozilla/thunderbirdunspecified — 115.0.1+1
▶NVDmozilla/thunderbird115.0 — 115.0.1+1
▶Debianmozilla/thunderbird< 1:102.13.1-1~deb11u1+3
▶Ubuntumozilla/thunderbird< 1:102.15.0+build1-0ubuntu0.20.04.1+1

Also affects: Debian Linux 10.0, 11.0, 12.0

🔴Vulnerability Details

4
OSV
thunderbird vulnerabilities↗2023-09-04
▶
CVEList
File Extension Spoofing using the Text Direction Override Character↗2023-07-24
▶
OSV
CVE-2023-3417: Thunderbird allowed the Text Direction Override Unicode Character in filenames↗2023-07-24
▶
GHSA
GHSA-xpxg-5vmj-vx9g: Thunderbird allowed the Text Direction Override Unicode Character in filenames↗2023-07-24
▶

📋Vendor Advisories

5
Ubuntu
Thunderbird vulnerabilities↗2023-09-04
▶
Red Hat
thunderbird: File Extension Spoofing using the Text Direction Override Character↗2023-07-20
▶
Debian
CVE-2023-3417: thunderbird - Thunderbird allowed the Text Direction Override Unicode Character in filenames. ...↗2023
▶
Mozilla
Mozilla Foundation Security Advisory 2023-27: CVE-2023-3417↗
▶
Mozilla
Mozilla Foundation Security Advisory 2023-28: CVE-2023-3417↗
▶
CVE-2023-3417 — Unrestricted File Upload in Mozilla | cvebase