| Package | Affected versions | Patched versions |
|---|---|---|
| webcit | ≤ 932 |
An issue was discovered in Citadel through webcit-932. A meddler-in-the-middle attacker can fixate their own session during the cleartext phase before a STARTTLS command (a violation of "The STARTTLS command is only valid in non-authenticated state." in RFC2595). This potentially allows an attacker to cause a victim's e-mail messages to be stored into an attacker's IMAP mailbox, but depends on details of the victim's client behavior.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free