CVE-2007-1137 putmail.py in Putmail before 1.4 does not detect when a user attempts to use TLS with a server that does not support it, which causes putmail.py to send the username and password in plaintext while th...
MediumCVSS 5.0
EPSS 0.92%
- Published
- Updated
- Exploit status
- No public exploit known
Description
putmail.py in Putmail before 1.4 does not detect when a user attempts to use TLS with a server that does not support it, which causes putmail.py to send the username and password in plaintext while the user believes encryption is in use, and allows remote attackers to obtain sensitive information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sourceforge putmail | = .8 | No fix listed |
| sourceforge putmail | = .9 | No fix listed |
| sourceforge putmail | = .10 | No fix listed |
| sourceforge putmail | = .11 | No fix listed |
| sourceforge putmail | = .12 | No fix listed |
| sourceforge putmail | = 1.0 | No fix listed |
| sourceforge putmail | = 1.1 | No fix listed |
| sourceforge putmail | = 1.2 | No fix listed |
| sourceforge putmail | = 1.3 | No fix listed |
References
- 33764 vdb-entry
- putmail.sourceforge.net
- 24266 third-party-advisory vendor-advisory
- 22718 vdb-entry
- ADV-2007-0753 vdb-entry
- putmail-tls-password-plaintext(32689) vdb-entry