Vulnerability · Published Dec 22, 2022 · Assigned by mozilla
CVE-2022-3155
High 7.8
In plain English
A high-severity incorrect default permissions in Thunderbird from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 87.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
When saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple.quarantine on the received file. If the received file was an application and the user attempted to open it, then the application was started immediately without asking the user to confirm. This vulnerability affects Thunderbird < 102.3.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Thunderbird | unspecified – before 102.3 |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H