CVE-2020-11880
Summary
| CVE | CVE-2020-11880 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-04-17 18:15:00 UTC |
| Updated | 2020-04-29 19:18:00 UTC |
| Description | An issue was discovered in KDE KMail before 19.12.3. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make KMail attach local files to a composed email message without showing a warning to the user, as demonstrated by an attach=.bash_history value. |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| cgit.kde.org/kmail.git/tag | MISC | cgit.kde.org | Vendor Advisory |
| cgit.kde.org/kmail.git/commit | MISC | cgit.kde.org | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 180717 Debian Security Update for kmail (CVE-2020-11880)