CVE-2023-0430

Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected by this bug. This vulnerability affects Thunderbird < 102.7.1.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1769000	Issue Tracking Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-04/	Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1769000	Issue Tracking Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-04/	Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1769000	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) El estado de revocación de certificados OCSP no se verificó al comprobar las firmas S/Mime. Un correo firmado con un certificado revocado se mostraría como si tuviera una firma válida. Las versiones de Thunderbird desde la 68 hasta la 102.7.0 se vieron afectadas por este error. Esta vulnerabilidad afecta a Thunderbird anterior a 102.7.1.

Information

Published : 2023-06-02 17:15

Updated : 2026-10-24 13:10

NVD link : CVE-2023-0430

Mitre link : CVE-2023-0430

CVE.ORG link : CVE-2023-0430

JSON object : View

Products Affected

mozilla

thunderbird

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2023-0430", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-0430", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-10T18:21:49.547229Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@mozilla.org", "affectedData": [{"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "102.7.1", "versionType": "custom"}]}]}], "published": "2023-06-02T17:15:10.280", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1769000", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2023-04/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1769000", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2023-04/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1769000", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected by this bug. This vulnerability affects Thunderbird < 102.7.1."}, {"lang": "es", "value": "El estado de revocaci\u00f3n de certificados OCSP no se verific\u00f3 al comprobar las firmas S/Mime. Un correo firmado con un certificado revocado se mostrar\u00eda como si tuviera una firma v\u00e1lida. Las versiones de Thunderbird desde la 68 hasta la 102.7.0 se vieron afectadas por este error. Esta vulnerabilidad afecta a Thunderbird anterior a 102.7.1."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DDF46FDD-FC32-4D77-A024-4EB6FD573FE6", "versionEndExcluding": "102.7.1", "versionStartIncluding": "68.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}