1. CVE-Search
  2. CVE-2014-2014
ID CVE-2014-2014
Summary imapsync before 1.584, when running with the --tls option, attempts a cleartext login when a certificate verification failure occurs, which allows remote attackers to obtain credentials by sniffing the network.
References
Vulnerable Configurations
  • cpe:2.3:a:imapsync_project:imapsync:*:*:*:*:*:*:*:*
    cpe:2.3:a:imapsync_project:imapsync:*:*:*:*:*:*:*:*
  • cpe:2.3:a:imapsync_project:imapsync:1.53:*:*:*:*:*:*:*
    cpe:2.3:a:imapsync_project:imapsync:1.53:*:*:*:*:*:*:*
  • cpe:2.3:a:imapsync_project:imapsync:1.547:*:*:*:*:*:*:*
    cpe:2.3:a:imapsync_project:imapsync:1.547:*:*:*:*:*:*:*
  • cpe:2.3:a:imapsync_project:imapsync:1.516:*:*:*:*:*:*:*
    cpe:2.3:a:imapsync_project:imapsync:1.516:*:*:*:*:*:*:*
  • cpe:2.3:a:imapsync_project:imapsync:1.504:*:*:*:*:*:*:*
    cpe:2.3:a:imapsync_project:imapsync:1.504:*:*:*:*:*:*:*
  • cpe:2.3:a:imapsync_project:imapsync:1.554:*:*:*:*:*:*:*
    cpe:2.3:a:imapsync_project:imapsync:1.554:*:*:*:*:*:*:*
  • cpe:2.3:a:imapsync_project:imapsync:1.500:*:*:*:*:*:*:*
    cpe:2.3:a:imapsync_project:imapsync:1.500:*:*:*:*:*:*:*
  • cpe:2.3:a:imapsync_project:imapsync:1.558:*:*:*:*:*:*:*
    cpe:2.3:a:imapsync_project:imapsync:1.558:*:*:*:*:*:*:*
  • cpe:2.3:a:imapsync_project:imapsync:1.567:*:*:*:*:*:*:*
    cpe:2.3:a:imapsync_project:imapsync:1.567:*:*:*:*:*:*:*
  • cpe:2.3:a:imapsync_project:imapsync:1.542:*:*:*:*:*:*:*
    cpe:2.3:a:imapsync_project:imapsync:1.542:*:*:*:*:*:*:*
  • cpe:2.3:a:imapsync_project:imapsync:1.569:*:*:*:*:*:*:*
    cpe:2.3:a:imapsync_project:imapsync:1.569:*:*:*:*:*:*:*
  • cpe:2.3:a:imapsync_project:imapsync:1.518:*:*:*:*:*:*:*
    cpe:2.3:a:imapsync_project:imapsync:1.518:*:*:*:*:*:*:*
  • cpe:2.3:a:imapsync_project:imapsync:1.508:*:*:*:*:*:*:*
    cpe:2.3:a:imapsync_project:imapsync:1.508:*:*:*:*:*:*:*
  • cpe:2.3:a:imapsync_project:imapsync:1.525:*:*:*:*:*:*:*
    cpe:2.3:a:imapsync_project:imapsync:1.525:*:*:*:*:*:*:*
  • cpe:2.3:a:imapsync_project:imapsync:1.564:*:*:*:*:*:*:*
    cpe:2.3:a:imapsync_project:imapsync:1.564:*:*:*:*:*:*:*
CVSS
Base: 4.3 (as of 07-06-2023 - 13:59)
Impact:
Exploitability:
CWE CWE-255
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:N/A:N
refmap via4
confirm
fedora FEDORA-2014-2505
mandriva MDVSA-2014:060
mlist
  • [imapsync_list] 20140120 Re: [imapsync] STARTTLS support (#15)
  • [imapsync_list] 20140122 Re: [imapsync] Upon certificate issues STARTTLS is ignored and the password sent in plaintext (#15)
  • [oss-security] 20140217 CVE request: "imapsync ignores the --tls switch and sends my authentication plaintext."
  • [oss-security] 20140218 Re: CVE request: "imapsync ignores the --tls switch and sends my authentication plaintext."
Last major update 07-06-2023 - 13:59
Published 18-04-2014 - 22:14
Last modified 07-06-2023 - 13:59
Back to Top