CVE-2019-11730: Medium severity thunderbird vulnerability
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may uploaded to a server. Luigi Gubello demonstrated that in combination with a popular Android messaging app, if a malicious HTML attachment is sent to a user and they opened that attachment in Firefox, due to that app's predictable pattern for locally-saved file names, it is possible to read attachments the victim received from other correspondents.
Other sources
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may uploaded to a server. It was demonstrated that in combination with a popular Android messaging app, if a malicious HTML attachment is sent to a user and they opened that attachment in Firefox, due to that app's predictable pattern for locally-saved file names, it is possible to read attachments the victim received from other correspondents. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2019-11730?
CVE-2019-11730 is a vulnerability that allows locally saved HTML files to access other files in the same directory or sub-directories.
Which software are affected by CVE-2019-11730?
Mozilla Thunderbird versions up to 60.8, Mozilla Thunderbird versions up to 68, Mozilla Firefox versions up to 68, Mozilla Firefox ESR versions up to 60.8, and Debian Linux, openSUSE Leap, Suse Package Hub are affected by CVE-2019-11730.
How can I exploit CVE-2019-11730?
To exploit CVE-2019-11730, an attacker would need to trick a user into opening a locally saved HTML file.
What is the severity of CVE-2019-11730?
CVE-2019-11730 has a severity rating of medium (6.5).
How can I mitigate CVE-2019-11730?
To mitigate CVE-2019-11730, update to Mozilla Thunderbird 60.8 or later, Mozilla Thunderbird 68 or later, or Mozilla Firefox 68 or later.