Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
231
VMScore

CVE-2020-28896

Published: 23/11/2020 Updated: 21/07/2021
CVSS v2 Base Score: 2.6 | Impact Score: 2.9 | Exploitability Score: 4.9
CVSS v3 Base Score: 5.3 | Impact Score: 3.6 | Exploitability Score: 1.6
VMScore: 231
Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N

Vulnerability Summary

Mutt prior to 2.0.2 and NeoMutt prior to 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

mutt mutt

neomutt neomutt

debian debian linux 9.0

Vendor Advisories

Amazon Linux 2: ALAS2-2022-1892
Mutt before 1143 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response (CVE-2020-14093) Mutt before 1143 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate (CVE-2020-14154) Mutt before 1144 and NeoMutt before 2020-06-19 have a STARTTLS bu ...
Arch Linux Issues:
A security issue has been found in Mutt before version 202 and NeoMutt before version 20201120 that could result in authentication credentials being sent over an unencrypted connection, without $ssl_force_tls being consulted During connection, if the server provided an illegal initial response, the application "bailed", but did not actually clos ...

References

CWE-287CWE-755https://github.com/neomutt/neomutt/commit/9c36717a3e2af1f2c1b7242035455ec8112b4b06https://gitlab.com/muttmua/mutt/-/commit/d92689088dfe80a290ec836e292376e2d9984f8fhttps://github.com/neomutt/neomutt/releases/tag/20201120https://gitlab.com/muttmua/mutt/-/commit/04b06aaa3e0cc0022b9b01dbca2863756ebbf59ahttps://lists.debian.org/debian-lts-announce/2020/11/msg00048.htmlhttps://security.gentoo.org/glsa/202101-32https://nvd.nist.govhttps://alas.aws.amazon.com/AL2/ALAS-2022-1892.html
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-4367CVE-2024-3611CVE-2024-4947CVE-2024-32988CVE-2020-35165local file inclusionCVE-2024-4980bypassmalicious code‎
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook