CVE-2025-3523
User Interface (UI) Misrepresentation of attachment URL
- State
- Published
- Severity
- 6.4 Medium
- Published
- Apr 15, 2025
- Updated
- Apr 13, 2026
- Reserved
- Apr 11, 2025
Description
When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.4 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L | CISA-ADP |
Weaknesses
- CWE-451 User Interface (UI) Misrepresentation of Critical Information
Affected Products
| Product | Versions |
|---|---|
ThunderbirdMozilla |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.