CVE-2023-46116

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it correctly blocks the `file:` URL scheme, which can be used by malicious actors to gain code execution on a victims computer, however fails to check other harmful schemes such as `ftp:`, `smb:`, etc. which can also be used. Successful exploitation of this vulnerability will enable an attacker to gain code execution on a victim's computer. Version 3.118.2 contains a patch for this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Dec 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-461178.8reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding o CVE-2023-461184.9RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for d CVE-2023-461197.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading CVE-2023-46129.8Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Auth CVE-2023-461207.5The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was CVE-2023-461213.7yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbi CVE-2023-461227.1sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. Thi CVE-2023-461235.3jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specificati CVE-2023-461247.2Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the CVE-2023-461256.5Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the CVE-2023-461265.4Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping CVE-2023-461275.4Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A ma