CVE-2020-15646

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 68.10.0

Description The issue arises when an attacker intercepts Thunderbird's initial attempt to set up an account automatically using the Microsoft Exchange autodiscovery mechanism. If the attacker sends a crafted response, Thunderbird will send the username and password over https to a server controlled by the attacker.

Recommendations For versions prior to 68.10.0, update to version 68.10.0 or later to resolve the issue. As a temporary workaround, consider disabling the autodiscovery mechanism for Microsoft Exchange until a patch is applied. Restrict access to sensitive information and avoid using automatic account setup features until the issue is resolved.