When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar…
When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This affected both setting up a new calendar and syncing existing calendars, where a saved password could be sent without any user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even for calendars served over HTTPS. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Mozilla
- Product
- Thunderbird
- Fix
- available
- Exposure class
- NVD status
- Awaiting Analysis
Why it ranks 32 (Notable)
- Exposed product class: email
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.