PT-2023-23703 · Mymail · Mymail

Published 2023-05-07 · Updated 2025-01-29 · CVE-2023-32290

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions myMail app versions through 14.30 for iOS

Description The issue concerns the myMail app sending cleartext credentials in a situation where STARTTLS is expected by a server. This occurs when the app is used with a server that expects a secure connection to be established using STARTTLS, but the app fails to initiate this secure connection, resulting in the transmission of credentials in plain text.

Recommendations For myMail app versions through 14.30 for iOS, consider updating to a version that properly implements STARTTLS to prevent cleartext credential transmission. As a temporary workaround, restrict the use of the myMail app with servers that expect STARTTLS until a patch is available.

Fix

Cleartext Transmission of Sensitive Information

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-319

CWE-311

Related Identifiers

CVE-2023-32290

Affected Products

Mymail

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-32290 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32290 · Vendor Advisory
• https://mailbox.org/en/post/mailbox-org-discovers-unencrypted-password-transmission-in-mymail · Vendor Advisory
• https://t.me/cvenotify/50310 · Telegram Post
• https://news.ycombinator.com/item?id=35845308 · Note
• https://t.me/cvenotify/109009 · Telegram Post
• https://apps.apple.com/fm/app/mymail-email-app-for-gmail/id722120997 · Note
• https://t.me/cibsecurity/63406 · Telegram Post