CVE-2021-37845

Katalog CVE

CVSS 3.7 · Low EPSS 0,66%

Kerentanan pada citadel webcit. Skor CVSS 3.1 3.7 (Low) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Citadel through webcit-932. A meddler-in-the-middle attacker can fixate their own session during the cleartext phase before a STARTTLS command (a violation of "The STARTTLS command is only valid in non-authenticated state." in RFC2595). This potentially allows an attacker to cause a victim's e-mail messages to be stored into an attacker's IMAP mailbox, but depends on details of the victim's client behavior.

Rincian

Terbit di NVD

29 Mei 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://uncensored.citadel.org/msg/2099264259 exploit
• http://uncensored.citadel.org/dotgoto?room=Citadel%20Security issue tracking
• https://nostarttls.secvuln.info/ broken link