CVE-2022-4055
- State
- Published
- Severity
- 7.4 High
- Published
- Nov 18, 2022
- Updated
- Apr 29, 2025
- Reserved
- Nov 17, 2022
Description
When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.4 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N | CISA-ADP |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
xdg-utilsn/a |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.