CVE-2024-23655

    Dashboard / Vulnerabilities / CVE-2024-23655

    CVE-2024-23655

    Published: 25 Jan 2024Last Modified: 12 Aug 2026

    Summary: Attacker can prevent users from accessing received emails

    Details: Tuta is an encrypted email service. Starting in version 3.118.12 and prior to version 3.119.10, an attacker is able to send a manipulated email so that the user can no longer use the app to get access to received emails. By sending a manipulated email, an attacker could put the app into an unusable state. In this case, a user can no longer access received e-mails. Since the vulnerability affects not only the app, but also the web application, a user in this case has no way to access received emails. This issue was tested with iOS and the web app, but it is possible all clients are affected. Version 3.119.10 fixes this issue.

    References: https://github.com/tutao/tutanota/releases/tag/tutanota-release-3.119.10, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23655.json, https://github.com/tutao/tutanota/security/advisories/GHSA-5h47-g927-629g, https://nvd.nist.gov/vuln/detail/CVE-2024-23655

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 6af9e8d02cba661cbb271c02c292a036a32624ad
    Fixed -2939aa9f4356f0dc9f523ee5ce19d09e08ab979b

    Affected versions

    tutanota-ios-release-3.119.10
    tutanota-ios-release-3.119.8
    tutanota-ios-release-3.119.3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-23655 | CVE-DB