Vulnerability Description
Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it correctly blocks the `file:` URL scheme, which can be used by malicious actors to gain code execution on a victims computer, however fails to check other harmful schemes such as `ftp:`, `smb:`, etc. which can also be used. Successful exploitation of this vulnerability will enable an attacker to gain code execution on a victim's computer. Version 3.118.2 contains a patch for this issue.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tuta | Tutanota | < 3.118.12 |
Related Weaknesses (CWE)
References
- https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#LProduct
- https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#LProduct
- https://github.com/tutao/tutanota/commit/88ecad17d00d05a722399aed35f0d280899d55aPatch
- https://github.com/tutao/tutanota/security/advisories/GHSA-mxgj-pq62-f644ExploitVendor Advisory
- https://user-images.githubusercontent.com/46137338/270564886-7a0389d3-f9ef-44e1-Exploit
- https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#LProduct
- https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#LProduct
- https://github.com/tutao/tutanota/commit/88ecad17d00d05a722399aed35f0d280899d55aPatch
- https://github.com/tutao/tutanota/security/advisories/GHSA-mxgj-pq62-f644ExploitVendor Advisory
- https://user-images.githubusercontent.com/46137338/270564886-7a0389d3-f9ef-44e1-Exploit
FAQ
What is CVE-2023-46116?
CVE-2023-46116 is a vulnerability with a CVSS score of 9.3 (CRITICAL). Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it correctly blocks the `file:` URL scheme, whic...
How severe is CVE-2023-46116?
CVE-2023-46116 has been rated CRITICAL with a CVSS base score of 9.3/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-46116?
Check the references section above for vendor advisories and patch information. Affected products include: Tuta Tutanota.