Bypass of remote UNC path restriction in mailbox: URLs
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Mozilla Thunderbird on Windows is affected. A specially crafted email could trick it into connecting to an attacker-chosen network server, exposing the user's Windows account name and NTLM login data that could then be used to attempt password cracking or relay attacks.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Timeline
- CVE published
- First seen by cve.now
- Record last updated
Affected versions
- Mozilla Thunderbird
Version range not reported