CVE-2020-37248

Published: Jun 8, 2026Modified: Jul 23, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Exploitability: 2.2 / Impact: 4.2

Source: MITRE (Secondary)

Description

OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to authentication, which allows STRIPTLS/man-in-the-middle attacks, taking over the connection and extracting account credentials in cleartext.

Related CWEs

CWE-348

Use of Less Trusted Source

The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

References (5)

https://github.com/OfflineIMAP/offlineimap/issues/669

Source: cve@mitre.org

https://github.com/OfflineIMAP/offlineimap3/commit/46505c53ef995455d66c685f9ec3ff6ea93dbb74

Source: cve@mitre.org

https://github.com/OfflineIMAP/offlineimap3/issues/222

Source: cve@mitre.org

https://pypi.org/project/offlineimap/#history

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2026/06/08/3

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.