CVE-2021-38372

LOW

Published Aug 10, 20214y ago · Modified Jun 17, 20262w ago

3.7 CVSS 3.1

Low

Published Aug 10, 2021 4y ago

Last Modified Jun 17, 2026 2w ago

Description

In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS.

Base Score

3.7

Exploitability

2.2

Impact

1.4

Vector string

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector Network

Attack Complexity High

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality None

Integrity Low

Availability None

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

Public Exploit Known

No Patch Available

CWE-77 Command Injection Injection

Vendor	Product	Version	Range
kde	trojita	0.7	any

bugs.kde.org https://bugs.kde.org/show_bug.cgi?id=432353

Mailing ListVendor Advisory
nostarttls.secvuln.info https://nostarttls.secvuln.info

ExploitThird Party Advisory

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.