← Back

CVE-2018-20954

nvd nist
Published: Aug 8, 2019Modified: Nov 21, 2024

JSON object

Loading...
7.5
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys.

Affected (7)

Products: Mailpile: Mailpile
Mailpile
1 product
Mailpile
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Mailpile
Mailpile
Version 0.5.0
Mailpile
Version 0.5.1
Mailpile
Version 0.5.2
Mailpile
Version 1.0.0 rc0
Mailpile
Version 1.0.0 rc1
Mailpile
Version 1.0.0 rc2
Mailpile
Version 1.0.0 rc3

Related CWEs

CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (6)

Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.