CVE-2018-15668
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Bloop Airmail for macOS是意大利Bloop公司的一款基于macOS平台的电子邮件应用程序。 基于macOS平台的Bloop Airmail 3 3.5.9版本中存在安全漏洞。攻击者可借助airmail:// URL scheme中的‘send’命令利用该漏洞使用目标账户向目标地址发送任意邮件。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2018-15668
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. The "send" command in the airmail:// URL scheme allows an external application to send arbitrary emails from an active account. URL parameters for the "send" command with the "attachment_" prefix designate attachment parameters. If the value of an attachment parameter corresponds to an accessible file path, the file is attached to the outbound message. In addition, relative file paths are acceptable attachment parameter values. The handler can be invoked using any method that invokes the URL handler such as a hyperlink in an email. The user is not prompted when the handler processes the "send" command, thus leading to automatic transmission of an email with designated attachments from the target account to a target address.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Bloop Airmail for macOS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Bloop Airmail for macOS是意大利Bloop公司的一款基于macOS平台的电子邮件应用程序。 基于macOS平台的Bloop Airmail 3 3.5.9版本中存在安全漏洞。攻击者可借助airmail:// URL scheme中的‘send’命令利用该漏洞使用目标账户向目标地址发送任意邮件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2018-15668
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-15668
请登录查看更多情报信息。
Other References for CVE-2018-15668 (1)
-
https://versprite.com/advisories/airmail-3-for-mac-2/ x_refsource_MISC
Same Patch Batch · n/a · 2018-08-21 · 17 CVEs total
| CVE-2018-0501 | Advanced Package Tool 安全漏洞 | |
| CVE-2018-15598 | Containous Traefik 安全漏洞 | |
| CVE-2018-15599 | Dropbear 安全漏洞 | |
| CVE-2018-15601 | Elefant CMS 安全漏洞 | |
| CVE-2018-15603 | Victor CMS 跨站脚本漏洞 | |
| CVE-2018-15607 | ImageMagick 安全漏洞 | |
| CVE-2018-15481 | UCOPIA Wireless Appliance 安全漏洞 | |
| CVE-2018-15528 | Java System Solutions SSO plugin for BMC MyIT 跨站脚本漏洞 | |
| CVE-2018-15533 | Geutebrueck re_porter 跨站脚本漏洞 | |
| CVE-2018-15534 | Geutebrueck re_porter 安全漏洞 | |
| CVE-2018-15660 | ANI Ola Money application for Android 安全漏洞 | |
| CVE-2018-15661 | ANI Ola Money application for Android 安全漏洞 | |
| CVE-2018-15667 | Bloop Airmail for macOS 授权问题漏洞 | |
| CVE-2018-15669 | Bloop Airmail for macOS 安全漏洞 | |
| CVE-2018-15670 | Bloop Airmail for macOS 输入验证错误漏洞 | |
| CVE-2018-15671 | HDF5 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2018-15668
No comments yet