Auth bypass in Airmailapp Airmail
CVE-2018-15667
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. It registers and uses the airmail:// URL scheme. The "send" command in the URL scheme allows an external application to send arbitrary emails from an active account without authentication. The handler has no restriction on who can use its functionality. The handler can be invoked using any method that invokes the URL handler such as a hyperlink in an email. The user is not prompted when the handler processes the "send" command, thus leading to automatic transmission of an attacker crafted email from the target account.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.010 (60.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 60.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Airmailapp Airmail — versions 3.3.5.9
Weakness classification (CWE)
References
- versprite.com/advisories/airmail-3-for-mac/ (Third Party Advisory)
Frequently asked questions
- What is CVE-2018-15667?
- CVE-2018-15667 is a high-severity vulnerability in Airmailapp Airmail, classified under Improper Authentication. CVSS score: 7.5/10. Published 2018-08-21.
- How severe is CVE-2018-15667?
- High severity. CVSS v3 base score is 7.5 out of 10.