Incomplete Blacklist of Frame Owning Elements: CVE-2018-15669

Home | Research | Resources | Advisories | Airmail 3 for Mac

Airmail 3 for Mac

Incomplete Blacklist of Frame Owning Elements

CVE ID

CVE-2018-15669

VENDOR

Bloop S.R.L.

PRODUCT

Airmail 3 for Mac

Product version

3.5.9

Vulnerability Details

Airmail's primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that requests from HTMLIFrameElements are blacklisted. However, other sub-classes of HTMLFrameOwnerElements are not forbidden by the policy. An attacker may abuse HTML Plug-In Elements within an email to trigger Frame navigation requests that bypass this filter.

Learn More →

Vendor response

No response.

Disclosure timeline

08-06-2018 - Vendor disclosure via email
08-13-2018 - Vendor notified via Support Page
08-21-2018 - Vendor notified of the advisory release

VerSprite and we45 Partner to Operationalize Security Training

Upcoming Event

Web Application Security

Today, leading cybersecurity service provider VerSprite and security training leader we45 announce a partnership to operationalize security training. The joint effort will result in a comprehensive full-stack security training program to equip organizations to handle any security challenges that may arise. “VerSprite has always taken a risk-first approach to cybersecurity, even inventing the PASTA risk …

Continue reading “VerSprite and we45 Partner to Operationalize Security Training”

Why Bad Guys do Bad Things:

Blog Post

Security Operations Centers

In this briefing, VerSprite’s Threat Intelligence Team covers “Why Bad Guys do Bad Things?” and why Threat Intelligence Analysts should possess the knowledge of who threat actors are and what drives their criminality.

Analyzing the State of Cybersecurity

Blog Post

Healthcare & Wellness Industry

In this blog, we look back at how the cybersecurity landscape has drastically changed in 2022, what influenced the uptick in cybercrime, and what you need to be aware of to better prepare for the coming year. Our Envisions is a leading threat report, produced by the VerSprite team of cybersecurity analysts, that encompasses cyber trends and geopolitical themes to provide the best expert overview of the state of cybersecurity.

We are an international squad of professionals working as one.

[email protected]