CVE-2021-37746

· MEDIUMModified

← All CVEs

CVSS v3.1

6.1

EPSS

1.16%

Published

Jul 30, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks before accepting a click.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-601

Affected Products (4)

claws-mail · claws-mail (up to 3.18.0)vulnerable

sylpheed_project · sylpheedvulnerable

fedoraproject · fedoravulnerable

References (10)

https://claws-mail.org/download.php?file=releases/claws-mail-3.18.0.tar.xz

PatchVendor Advisory

https://git.claws-mail.org/?p=claws.git%3Ba=commit%3Bh=ac286a71ed78429e16c612161251b9ea90ccd431

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L2QNUIWASJLPUZZKWICGCEGYJZCQE7NH/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RCJXHUSYHGVBSH2ULD7HNXLM7QNRECZ6/

https://sylpheed.sraoss.jp/sylpheed/v3.7/sylpheed-3.7.0.tar.xz

PatchThird Party Advisory