Meddler-in-the-middle Vulnerability in SmarterMail by SmarterTools
CVE-2020-29548

8.1HIGH

Key Information:

Vendor

Smartertools

Status
Smartermail
Vendor
CVE Published:
17 August 2021

What is CVE-2020-29548?

An issue has been identified in SmarterTools' SmarterMail software that enables attackers leveraging a meddler-in-the-middle strategy to pipeline commands following a POP3 STLS command. This vulnerability allows the injection of plaintext commands into what should be a secure encrypted user session, significantly jeopardizing user data integrity and confidentiality.

References

https://www.smartertools.com/smartermail/release-notes/cu...
x_refsource_MISC
https://nostarttls.secvuln.info/
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.