5.0med
CVE-2007-1137
putmail.py in Putmail before 1.4 does not detect when a user attempts to use TLS with a server that does not support it, which causes putma…
Published 19 y ago · modified 4 mo ago · JSON
CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 60%
Public exploits
0
none known
Summary
putmail.py in Putmail before 1.4 does not detect when a user attempts to use TLS with a server that does not support it, which causes putmail.py to send the username and password in plaintext while the user believes encryption is in use, and allows remote attackers to obtain sensitive information.
Exploit prediction (EPSS)
0.92% probability of exploitation in the next 30 days, higher than 60% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
References
- vupen.com /english/advisories/2007/0753 · vdb-entry, x_refsource_VUPEN, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/32689 · vdb-entry, x_refsource_XF, x_transferred
- securityfocus.com /bid/22718 · vdb-entry, x_refsource_BID, x_transferred
- putmail.sourceforge.net /home.html · x_refsource_CONFIRM, x_transferred
- secunia.com /advisories/24266 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- osvdb.org /33764 · vdb-entry, x_refsource_OSVDB, x_transferred
Sources
- CVE List: CVE-2007-1137
- NVD: CVE-2007-1137
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.