Bypass primary password by clicking "Cancel"
Categories
(Thunderbird :: Security, defect)
Tracking
(Not tracked)
People
(Reporter: bugzilla, Unassigned)
Details
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Steps to reproduce:
OS: Windows 11 Pro, Version 10.0.22621 Build 22621
Thunderbird: 115.3.1 (64-bit)
Set a primary password, close Thunderbird and reopen it. You will be asked for the primary password. Click "Cancel" and do everything you want (read / delete mails, change settings,...).
Actual results:
If you get asked for the primary password, just click "Cancel / Abort" and if asked again, click "Cancel" again. Now all mails get accessible and even if the pop-up for the primary password shows up again after a while, just click "Cancel" again and you are able to read all e-mails, delete them, change settings. On
Expected results:
Without entering the correct primary password, the program should not start at all, especially not give an unauthored user access to all mails and settings. This bug is present for years now in earlier version of Thunderbird and I am quiet shocked that it never got fixed.
|
||
Comment 1•3 years ago
|
||
The primary password is designed to only protect passwords. Cached data can be read.
Description
•