PT-2021-23791 · Datalust · Datalust Seq.App.Emailplus

Liammclennan + 1 · Published 2021-11-02 · Updated 2023-08-08 · CVE-2021-43270

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Datalust Seq.App.EmailPlus (aka seq-app-htmlemail) versions 3.1.0-dev-00148 through 3.1.0-dev-00176

Description The issue arises when Datalust Seq.App.EmailPlus uses cleartext SMTP on port 25 in cases where encryption on port 465 was intended. This can potentially expose sensitive information.

Recommendations For versions 3.1.0-dev-00148 through 3.1.0-dev-00176, consider configuring the application to use encrypted SMTP on port 465 to prevent the use of cleartext SMTP on port 25. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2021-43270

Affected Products

Datalust Seq.App.Emailplus

References · 5

• https://github.com/datalust/seq-app-htmlemail/pull/93 · Patch
• https://osv.dev/vulnerability/CVE-2021-43270 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43270 · Security Note
• https://t.me/cibsecurity/31670 · Telegram Post
• https://t.me/cvenotify/22916 · Telegram Post