Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2020-15954 |
CWE-ID | CWE-319 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
kmail Client/Desktop applications / Other client software |
Vendor | KDE.org |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU34051
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-15954
CWE-ID:
CWE-319 - Cleartext Transmission of Sensitive Information
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.
MitigationInstall update from vendor's website.
Vulnerable software versionskmail: 19.12.3
External linkshttp://bugs.kde.org/show_bug.cgi?id=423426
http://lists.debian.org/debian-lts-announce/2020/07/msg00030.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.