6.8

CVE-2011-1430

The STARTTLS implementation in the server in Ipswitch IMail 11.03 and earlier does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.

Data is provided by the National Vulnerability Database (NVD)
Ipswitch ≫ Imail Version <= 11.03
Ipswitch ≫ Imail Version5.0
Ipswitch ≫ Imail Version5.0.5
Ipswitch ≫ Imail Version5.0.6
Ipswitch ≫ Imail Version5.0.7
Ipswitch ≫ Imail Version5.0.8
Ipswitch ≫ Imail Version6.00
Ipswitch ≫ Imail Version6.0
Ipswitch ≫ Imail Version6.0.1
Ipswitch ≫ Imail Version6.0.2
Ipswitch ≫ Imail Version6.0.3
Ipswitch ≫ Imail Version6.0.4
Ipswitch ≫ Imail Version6.0.5
Ipswitch ≫ Imail Version6.0.6
Ipswitch ≫ Imail Version6.1
Ipswitch ≫ Imail Version6.2
Ipswitch ≫ Imail Version6.3
Ipswitch ≫ Imail Version6.4
Ipswitch ≫ Imail Version6.06
Ipswitch ≫ Imail Version7.0.1
Ipswitch ≫ Imail Version7.0.2
Ipswitch ≫ Imail Version7.0.3
Ipswitch ≫ Imail Version7.0.4
Ipswitch ≫ Imail Version7.0.5
Ipswitch ≫ Imail Version7.0.6
Ipswitch ≫ Imail Version7.0.7
Ipswitch ≫ Imail Version7.1
Ipswitch ≫ Imail Version7.12
Ipswitch ≫ Imail Version8.0.3
Ipswitch ≫ Imail Version8.0.5
Ipswitch ≫ Imail Version8.1
Ipswitch ≫ Imail Version8.01
Ipswitch ≫ Imail Version8.11
Ipswitch ≫ Imail Version8.12
Ipswitch ≫ Imail Version8.13
Ipswitch ≫ Imail Version8.22
Ipswitch ≫ Imail Version10
Ipswitch ≫ Imail Version10.01
Ipswitch ≫ Imail Version10.02
Ipswitch ≫ Imail Version11
Ipswitch ≫ Imail Version11.01
Ipswitch ≫ Imail Version11.02
Ipswitch ≫ Imail Version2006
Ipswitch ≫ Imail Version2006.1
Ipswitch ≫ Imail Version2006.2
Ipswitch ≫ Imail Versionserver_8.2_hotfix_2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.42% 0.588
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.