PT-2020-5912 · Mutt+4 · Mutt+4
Damian Poddebniak
+1
·
Published
2020-06-15
·
Updated
2024-06-15
·
CVE-2020-14093
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Mutt versions prior to 1.14.3
Description:
The issue is related to insufficient data protection in the Mutt email client, allowing a remote attacker to perform a man-in-the-middle attack. Specifically, Mutt before version 1.14.3 is vulnerable to an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.
Recommendations:
For versions prior to 1.14.3, update to version 1.14.3 or later to resolve the issue. As a temporary workaround, consider disabling the IMAP fcc/postpone feature until a patch is available. Restrict access to sensitive email accounts to minimize the risk of exploitation. Avoid using the PREAUTH response in IMAP connections until the issue is resolved.
Fix
Information Disclosure
Cleartext Transmission of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Linuxmint
Mutt
Suse
Ubuntu