CVE-2021-33515

· MEDIUMModified

← All CVEs

CVSS v3.1

4.8

EPSS

2.84%

Published

Jun 28, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-77

Affected Products (4)

dovecot · dovecot (up to 2.3.14.1)vulnerable

fedoraproject · fedoravulnerable

debian · debian_linuxvulnerable

References (12)

https://dovecot.org/security

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/

https://security.gentoo.org/glsa/202107-41

Third Party Advisory

https://www.openwall.com/lists/oss-security/2021/06/28/2

Mailing ListThird Party Advisory

https://dovecot.org/security

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/

https://security.gentoo.org/glsa/202107-41

Third Party Advisory

https://www.openwall.com/lists/oss-security/2021/06/28/2

Mailing ListThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs