CVE-2018-15670
Last modified
CVE-2018-15670 is a vulnerability of currently unknown severity. An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that OpenURL is the default URL handler. EPSS estimates a 0.74% chance of exploitation in the next 30 days.
Description
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that OpenURL is the default URL handler. A navigation request is processed by the default URL handler only if the currentEvent is NX_LMOUSEUP or NX_OMOUSEUP. An attacker may abuse HTML elements with an EventHandler for a chance to validate navigation requests for URLs that are processed during the NX_LMOUSEUP event triggered by clicking an email.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Bloop | Airmail | 3.3.5.9 |
References
- https://versprite.com/advisories/airmail-3-for-mac-4/Third Party Advisory
- https://versprite.com/advisories/airmail-3-for-mac-4/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-15670?
How severe is CVE-2018-15670?
How do I fix CVE-2018-15670?
Are you affected by CVE-2018-15670?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST