VulnerabilityModified

CVE-2017-5658

This could lead to derived information disclosure on private lists about the timing of specific email subjects or text bodies, though without disclosing the content itself.

MEDIUM 5.3EPSS 1.82%

Does this matter?

Lower severity and a low EPSS score (1.82%). Track it; it rarely justifies an emergency change on its own.

Description

The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private lists about the timing of specific email subjects or text bodies, though without disclosing the content itself. As this was primarily used as a caching feature for faster loading times, the caching was disabled by default to prevent this. Users using 0.9 should upgrade to 0.10 to address this issue.

CVSS 3.0: 5.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 1.82% probability · 78th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: apache/pony mail
Source: security@apache.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.