CVE-2019-9147

MEDIUM

Mailvelope < 3.1.0 - Clickjacking via Settings Page Bypass

Title source: llm

Description

Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is intended to be accessible from web applications, the browser's extension isolation mechanisms are disabled (web_accessible_resources). Mailvelope implements additional measures to prevent web applications from directly embedding the settings page, but this mechanism can be bypassed.

References (3)

Core 3

Core References

Release Notes, Third Party Advisory x_refsource_confirm

https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v310

View Writeup ZIP pw:eip

Various Sources x_refsource_misc

https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html

Various Sources x_refsource_misc

https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3

Scores

CVSS v3 4.3

EPSS 0.0144

EPSS Percentile 69.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Details

CWE

CWE-1021

Status published

Products (1)

mailvelope/mailvelope < 3.1.0

Published Jul 09, 2019

Tracked Since Feb 18, 2026