CoreCVE
Back

HIGH

Leak of hashed Window credentials via crafted attachment URL

Published Apr 15, 2025

Description

Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validated or sanitized, it can reference internal resources like chrome:// or SMB share file:// links, potentially leading to hashed Windows credential leakage and opening the door to more serious security issues. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.

Affected products

Remediation

Red Hat statement

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Weaknesses (2)

CWE-1220

CWE-601

Open Redirect

References (8)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mozilla
Published Apr 15, 2025
Updated Apr 13, 2026
Reserved Apr 11, 2025
Link CVE-2025-3522
CISA Vulnrichment
Updated Apr 15, 2025
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2025-3522
Red Hat
Severity Important
Public date Apr 15, 2025
Links CVE-2025-3522 - Bugzilla
ENISA EUVD
Assigner mozilla
Published Apr 15, 2025
Updated Apr 13, 2026
Exploited since n/a
Link EUVD-2025-10965
EUVD-2025-10965