CVE-2021-38502

Katalog CVE

CVSS 5.9 · Medium EPSS 1,1%

Kerentanan pada mozilla thunderbird, debian linux. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication method was configured, the MITM could obtain the authentication credentials, too. This vulnerability affects Thunderbird < 91.2.

Rincian

Terbit di NVD

3 November 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.mozilla.org/show_bug.cgi?id=1733366 issue tracking · permissions required · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2021-47/ advisory vendor
• https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html mailing list · advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5034 issue tracking · advisory pihak ketiga