CVE-2021-38502

 

Published at: - 03-11-2021 02:15

Last modified: - 17-03-2022 08:37

Total changes: - 3

Description

Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication method was configured, the MITM could obtain the authentication credentials, too. This vulnerability affects Thunderbird < 91.2.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

 

Verification logic

 

Reference

• https://bugzilla.mozilla.org/show_bug.cgi?id=1733366
• https://www.mozilla.org/security/advisories/mfsa2021-47/
• DSA-5034-Issue Tracking, Third Party Advisory
• [debian-lts-announce] 20220104 [SECURITY] [DLA 2874-1] thunderbird security update-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2021-38502

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures