CVE Feed

    Dashboard / CVE / CVE-2020-11880

    CVE-2020-11880

    An issue was discovered in KDE KMail before 19.12.3. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make KMail attach local files to a composed email message without showing a warning to the user, as demonstrated by an attach=.bash_history value.

    Published:Apr 17, 2020
    Last Modified:Nov 21, 2024
    EPS:Apr 17, 2020
    EPSS Score:0.00366
    CVSS Score:6.5

    Affected Products

    Vendor
    Kde
    Product
    Kmail

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2024-50624 (CVSS 5.9) — ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-co…
    CVE-2021-38373 (CVSS 5.3) — In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) u…
    CVE-2020-15954 (CVSS 6.5) — KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates th…
    CVE-2019-10732 (CVSS 4.3) — In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts wit…
    CVE-2017-17689 (CVSS 5.9) — The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly l…
    CVE-2017-9604 (CVSS 7.5) — KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not …
    CVE-2016-7967 (CVSS 8.1) — KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html…
    CVE-2016-7968 (CVSS 6.5) — KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were …
    CVE-2016-7966 (CVSS 7.3) — Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaint…
    CVE-2014-8878 (CVSS 5.9) — KDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which allows remote a…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High