CVE-2020-12397
MEDIUMCVSS 4.3/10EPSS 0.60%
Last modified
CVE-2020-12397 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0.. EPSS estimates a 0.60% chance of exploitation in the next 30 days.
Description
By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Thunderbird | < 68.8.0 |
| Canonical | Ubuntu Linux | 16.04 |
| Canonical | Ubuntu Linux | 18.04 |
| Canonical | Ubuntu Linux | 19.10 |
| Canonical | Ubuntu Linux | 20.04 |
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1617370Issue Tracking, Patch, Vendor Advisory
- https://security.gentoo.org/glsa/202005-03Third Party Advisory
- https://usn.ubuntu.com/4373-1/Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-18/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1617370Issue Tracking, Patch, Vendor Advisory
- https://security.gentoo.org/glsa/202005-03Third Party Advisory
- https://usn.ubuntu.com/4373-1/Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-18/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-12397?
By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0.
How severe is CVE-2020-12397?
CVE-2020-12397 has a CVSS score of 4.3/10 (MEDIUM severity). The EPSS model estimates a 0.60% probability of exploitation in the next 30 days.
How do I fix CVE-2020-12397?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-12391Documents formed using data: URLs in an OBJECT element faile…7.5
- CVE-2020-12392The 'Copy as cURL' feature of Devtools' network tab did not …5.5
- CVE-2020-12393The 'Copy as cURL' feature of Devtools' network tab did not …7.8
- CVE-2020-12394A logic flaw in our location bar implementation could have a…3.3
- CVE-2020-12395Mozilla developers and community members reported memory saf…9.8
- CVE-2020-12396Mozilla developers and community members reported memory saf…9.8
- CVE-2020-12398If Thunderbird is configured to use STARTTLS for an IMAP ser…7.5
- CVE-2020-12399NSS has shown timing differences when performing DSA signatu…4.4
- CVE-2020-1240A remote code execution vulnerability exists in Microsoft Ex…8.8
- CVE-2020-12400When converting coordinates from projective to affine, the m…4.7
- CVE-2020-12401During ECDSA signature generation, padding applied in the no…4.7
- CVE-2020-12402During RSA key generation, bignum implementations used a var…4.4
Are you affected by CVE-2020-12397?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST