CVE-2021-38373

low-risk

Published 2021-08-10

In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked.

Do I need to act?

0.16% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

NETWORK / HIGH complexity

Affected Products (1)

Kmail

Affected Vendors

Kde

References (4)

Mailing List https://bugs.kde.org/show_bug.cgi?id=423423

Third Party Advisory https://nostarttls.secvuln.info

Mailing List https://bugs.kde.org/show_bug.cgi?id=423423

Third Party Advisory https://nostarttls.secvuln.info

/ 100

low-risk

Severity 17/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal