CVE-2018-15670: bloop airmail Improper Input Validation

Vulnerability summary

CVE-2018-15670 is a medium (CVSS 4.3) Improper Input Validation vulnerability in bloop airmail. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 53.6% of scored vulnerabilities.

Timeline

1. 21-08-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that OpenURL is the default URL handler. A navigation request is processed by the default URL handler only if the currentEvent is NX_LMOUSEUP or NX_OMOUSEUP. An attacker may abuse HTML elements with an EventHandler for a chance to validate navigation requests for URLs that are processed during the NX_LMOUSEUP event triggered by clicking an email.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.