« Volver al listado

CVE-2017-9604

Estado: ModificadaAlta (7.5)—

KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

KDE — KmailKDE — Messagelib

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-9604",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-06-13T13:29:00.220",
  "references": [
    {
      "url": "https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8",
      "tags": [
        "Mailing List",
        "Patch",
        "Tool Signature"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://commits.kde.org/messagelib/c54706e990bbd6498e7b1597ec7900bc809e8197",
      "tags": [
        "Mailing List",
        "Patch",
        "Tool Signature"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8",
      "tags": [
        "Mailing List",
        "Patch",
        "Tool Signature"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://commits.kde.org/messagelib/c54706e990bbd6498e7b1597ec7900bc809e8197",
      "tags": [
        "Mailing List",
        "Patch",
        "Tool Signature"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-311"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network."
    },
    {
      "lang": "es",
      "value": "KDE kmail anterior a la 5.5.2 y messagelib anterior a la 5.5.2, como distribuciones en aplicaciones KDE anteriores a la 17.04.2, no asegura que la acción de firma del plugin ocurre durante el uso de la característica Send Later, lo que permite a un atacante remoto obtener información sensible mediante la observación de la red."
    }
  ],
  "lastModified": "2026-06-17T01:28:33.570",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kde:kmail:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AFE05B36-25E9-45C3-B954-23274FF27E23",
              "versionEndIncluding": "5.5.1"
            },
            {
              "criteria": "cpe:2.3:a:kde:messagelib:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EFB5A70C-A555-4661-AD17-FFD7B8401A76",
              "versionEndIncluding": "5.5.1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:kde:kde:17.04:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "65A3F3E7-0DD1-44DE-BE29-72C6CEA77327"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}