CVE-2018-15668: Infoleak
First published: Tue Aug 21 2018(Updated: )
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. The "send" command in the airmail:// URL scheme allows an external application to send arbitrary emails from an active account. URL parameters for the "send" command with the "attachment_" prefix designate attachment parameters. If the value of an attachment parameter corresponds to an accessible file path, the file is attached to the outbound message. In addition, relative file paths are acceptable attachment parameter values. The handler can be invoked using any method that invokes the URL handler such as a hyperlink in an email. The user is not prompted when the handler processes the "send" command, thus leading to automatic transmission of an email with designated attachments from the target account to a target address.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bloop Airmail 3 | =3.5.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this issue in Bloop Airmail 3?
The vulnerability ID for this issue in Bloop Airmail 3 is CVE-2018-15668.
What is the severity rating of CVE-2018-15668?
CVE-2018-15668 has a severity rating of 5.3 (Medium).
What is affected by CVE-2018-15668?
Bloop Airmail 3 version 3.5.9 for macOS is affected by CVE-2018-15668.
How does CVE-2018-15668 work?
CVE-2018-15668 allows an external application to send arbitrary emails from an active account in Bloop Airmail 3.
Is there a fix available for CVE-2018-15668?
At the time of this advisory, there is no known fix for CVE-2018-15668. It is recommended to contact the vendor or apply any available patches or updates provided by Bloop Airmail 3.
- collector/nvd-index
- agent/severity
- agent/references
- agent/author
- agent/type
- agent/weakness
- agent/tags
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/bloop
- canonical/bloop airmail 3
- version/bloop airmail 3/3.5.9