CVE Feed

    Dashboard / CVE / CVE-2024-50624

    CVE-2024-50624

    ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is used for a URL such as http://autoconfig.example.com or http://example.com/.well-known/autoconfig for retrieving the configuration. This is related to kmail-account-wizard.

    Published:Oct 27, 2024
    Last Modified:Apr 15, 2026
    EPS:Oct 27, 2024
    EPSS Score:0.00041
    CVSS Score:5.9

    Affected Products

    Vendor
    Kde
    Product
    Kmail

    Exploits

    No exploit reference

    Related CVEs

    CVE-2021-38373 (CVSS 5.3) — In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) u…
    CVE-2020-15954 (CVSS 6.5) — KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates th…
    CVE-2020-11880 (CVSS 6.5) — An issue was discovered in KDE KMail before 19.12.3. By using the proprietary (non-RFC6068) "mailto?attach=...…
    CVE-2019-10732 (CVSS 4.3) — In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts wit…
    CVE-2017-17689 (CVSS 5.9) — The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly l…
    CVE-2017-9604 (CVSS 7.5) — KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not …
    CVE-2016-7967 (CVSS 8.1) — KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html…
    CVE-2016-7968 (CVSS 6.5) — KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were …
    CVE-2016-7966 (CVSS 7.3) — Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaint…
    CVE-2014-8878 (CVSS 5.9) — KDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which allows remote a…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High