PT-2021-11690 · Smartertools · Smartermail

Published 2021-08-17 · Updated 2021-08-25 · CVE-2020-29548

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SmarterTools SmarterMail versions through 100.0.7537

Description: An issue allows meddler-in-the-middle attackers to pipeline commands after a POP3 STLS command, injecting plaintext commands into an encrypted user session. This can be exploited by attackers to inject commands into the user's session.

Recommendations: For SmarterTools SmarterMail versions through 100.0.7537, consider disabling the POP3 STLS command functionality until a patch is available to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2020-29548

Affected Products

Smartermail

References · 6

• https://smartertools.com/smartermail/release-notes/current · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-29548 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29548 · Security Note
• https://t.me/cibsecurity/27456 · Telegram Post
• https://nostarttls.secvuln.info · Note
• https://t.me/cvenotify/20061 · Telegram Post