5.9

CVE-2021-38502

EPSS 0.46%
Published 03.11.2021 01:15:07
Last modified 21.11.2024 06:17:15
Source security@mozilla.org
Teams watchlist Login
Open Login

Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication method was configured, the MITM could obtain the authentication credentials, too. This vulnerability affects Thunderbird < 91.2.

Affected products Warnungen 0 Metrics 3 CWE 0 References 7

Data is provided by the National Vulnerability Database (NVD)

Mozilla ≫ Thunderbird Version < 91.2

Debian ≫ Debian Linux Version9.0

Debian ≫ Debian Linux Version10.0

Debian ≫ Debian Linux Version11.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.46%	0.631

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.9	2.2	3.6	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:P/I:N/A:N

https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html

Third Party Advisory

Mailing List

https://www.debian.org/security/2022/dsa-5034

Third Party Advisory

Issue Tracking

https://www.mozilla.org/security/advisories/mfsa2021-47/

Vendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=1733366

Vendor Advisory

Issue Tracking

Permissions Required

https://nvd.nist.gov/vuln/detail/CVE-2021-38502

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-38502

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-38502

EUVD