Lucene search
GitHub Advisory DatabaseGHSA-WGJV-9J3Q-JHG8HistoryMay 20, 2024 - 2:59 p.m.
aiosmtpd STARTTLS unencrypted commands injection
2024-05-2014:59:07
CWE-349
GitHub Advisory Database
github.com
5
aiosmtpd
starttls
unencrypted commands
injection
mitm attack
security vulnerability
5.4 Medium
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
7.4 High
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
15.7%
Summary
Servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a MitM attack.
References
Affected configurations
Node
aiosmtpdRange<1.4.6
Related
cve
cve
CVE-2024-34083
2024-05-18 19:15:49
ubuntucve
ubuntucve
CVE-2024-34083
2024-05-18 00:00:00
osv
osv
CVE-2024-34083
2024-05-18 19:15:49
aiosmtpd STARTTLS unencrypted commands injection
2024-05-20 14:59:07
debiancve
debiancve
CVE-2024-34083
2024-05-18 19:15:49
cvelist
cvelist
CVE-2024-34083 STARTTLS unencrypted commands injection
2024-05-18 18:12:19
veracode
veracode
Man-in-the-Middle (MITM)
2024-05-22 07:08:47
nvd
nvd
CVE-2024-34083
2024-05-18 19:15:49
vulnrichment
vulnrichment
CVE-2024-34083 STARTTLS unencrypted commands injection
2024-05-18 18:12:19
5.4 Medium
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
7.4 High
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
15.7%
Related for GHSA-WGJV-9J3Q-JHG8