CVE-2014-2567

Published: Mar 21, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The OpenConnectionTask::handleStateHelper function in Imap/Tasks/OpenConnectionTask.cpp in Trojita before 0.4.1 allows man-in-the-middle attackers to trigger use of cleartext for saving a message into a (1) sent or (2) draft folder via a PREAUTH response that prevents later use of the STARTTLS command.

Affected (14)

Products: Trojita Project: Trojita

Trojita Project

1 product

Trojita

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Trojita Project Trojita	Up to 0.4
Trojita Project Trojita	Version 0.1
Trojita Project Trojita	Version 0.2.9.1
Trojita Project Trojita	Version 0.2.9.2
Trojita Project Trojita	Version 0.2.9.3
Trojita Project Trojita	Version 0.2.9.4
Trojita Project Trojita	Version 0.2.9
Trojita Project Trojita	Version 0.2
Trojita Project Trojita	Version 0.3.90
Trojita Project Trojita	Version 0.3.91
Trojita Project Trojita	Version 0.3.92
Trojita Project Trojita	Version 0.3.93
Trojita Project Trojita	Version 0.3.96
Trojita Project Trojita	Version 0.3

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html

Source: cve@mitre.org

Vendor Advisory

https://github.com/jktjkt/trojita/commit/25fffa3e25cbad85bbca804193ad336b090a9ce1

Source: cve@mitre.org

http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://github.com/jktjkt/trojita/commit/25fffa3e25cbad85bbca804193ad336b090a9ce1

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.