CVE-2024-49395
Nov. 14, 2024, 1:33 p.m.
Tags
CVSS Score
Products Impacted
| Vendor | Product | Versions |
|---|---|---|
| mutt |
|
|
| neomutt |
|
|
| redhat |
|
|
Description
In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info.
Weaknesses
CWE-1230
Exposure of Sensitive Information Through Metadata
The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.
CWE ID: 1230Date
Published: Nov. 12, 2024, 3:15 a.m.
Last Modified: Nov. 14, 2024, 1:33 p.m.
Status : Analyzed
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
secalert@redhat.com
CPEs
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| a | mutt | mutt | - | / | / | / | / | / | / | / |
| a | neomutt | neomutt | - | / | / | / | / | / | / | / |
| o | redhat | enterprise_linux | 8.0 | / | / | / | / | / | / | / |
| o | redhat | enterprise_linux | 9.0 | / | / | / | / | / | / | / |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
Base Score
Exploitability Score
Impact Score
Base Severity
MEDIUMCVSS Vector String
The CVSS vector string provides an in-depth view of the vulnerability metrics.
View Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N