CVE-2022-1834
Last modified
CVE-2022-1834 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown with an arbitrary sender email address chosen by the attacker. EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown with an arbitrary sender email address chosen by the attacker. If the sender name started with a false email address, followed by many Braille space characters, the attacker's email address was not visible. Because Thunderbird compared the invisible sender address with the signature's email address, if the signing key or certificate was accepted by Thunderbird, the email was shown as having a valid digital signature. This vulnerability affects Thunderbird < 91.10.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Thunderbird | < 91.10 |
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1767816Issue Tracking, Permissions Required, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-22/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1767816Issue Tracking, Permissions Required, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-22/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-1834?
How severe is CVE-2022-1834?
How do I fix CVE-2022-1834?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-1828The PDF24 Articles To PDF WordPress plugin through 4.2.2 doe…6.5
- CVE-2022-1829The Inline Google Maps WordPress plugin through 5.11 does no…6.5
- CVE-2022-1830The Amazon Einzeltitellinks WordPress plugin through 1.3.3 d…6.5
- CVE-2022-1831The WPlite WordPress plugin through 1.3.1 does not have CSRF…6.5
- CVE-2022-1832The CaPa Protect WordPress plugin through 0.5.8.2 does not h…6.5
- CVE-2022-1833A flaw was found in AMQ Broker Operator 7.9.4 installed via …8.8
- CVE-2022-1835Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-1836Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-1837A vulnerability was found in Home Clean Services Management …7.2
- CVE-2022-1838A vulnerability classified as critical has been found in Hom…7.2
- CVE-2022-1839A vulnerability classified as critical was found in Home Cle…8.8
- CVE-2022-1840A vulnerability, which was classified as problematic, has be…4.8
Are you affected by CVE-2022-1834?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST