PT-2021-22086 · Kde · Kde Trojita

Damian Poddebniak · Published 2021-08-10 · Updated 2021-08-20 · CVE-2021-38372

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions KDE Trojita version 0.7

Description Man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS.

Recommendations For KDE Trojita version 0.7, consider disabling the acceptance of untagged responses from the IMAP server before STARTTLS as a temporary workaround until a patch is available. Restrict access to folder creation functionality to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2021-38372

Affected Products

Kde Trojita

References · 8

• 🔥 https://nostarttls.secvuln.info · Exploit
• https://cve.org/CVERecord?id=CVE-2021-38372 · Security Note
• https://bugs.kde.org/show_bug.cgi?id=432353 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38372 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38372 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-38372 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38372 · Vendor Advisory
• https://t.me/cibsecurity/27070 · Telegram Post