CVE-2021-38502
A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM.
Does this matter?
Lower severity and a low EPSS score (1.10%). Track it; it rarely justifies an emergency change on its own.
Description
Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication method was configured, the MITM could obtain the authentication credentials, too. This vulnerability affects Thunderbird < 91.2.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.10% probability · 64th percentile
- CISA KEV
- Not listed
- Affected
- mozilla/thunderbird · debian/debian linux
- Source
- security@mozilla.org
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1733366Issue Tracking, Permissions Required, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlMailing List, Third Party Advisory
- https://www.debian.org/security/2022/dsa-5034Issue Tracking, Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-47/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1733366Issue Tracking, Permissions Required, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlMailing List, Third Party Advisory
- https://www.debian.org/security/2022/dsa-5034Issue Tracking, Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-47/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.