CVE-2024-49393CWE-347

Mutt: neomutt: to and cc email header fields are not protected by cryptographic signing

Medium · published November 12, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
24.6
In the wild
Unconfirmed
What it is

In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00327 · 24.6th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2024-11-12T01:55Z
EPSS history
Timeline
  • 12 NOV 01:55Z
    Mutt: neomutt: to and cc email header fields are not protected by cryptographic signing
    cvelistv5