Medium severity · published Oct 27, 2024
CVE-2024-50624
ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is used for a URL such as…
5.9
CVSS
0.3%
EPSS
No
On KEV
Description
ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is used for a URL such as http://autoconfig.example.com or http://example.com/.well-known/autoconfig for retrieving the configuration. This is related to kmail-account-wizard.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KM
Kmail · Kde
before 6.2.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-50624
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-50624
bugs.kde.org
https://bugs.kde.org/show_bug.cgi?id=487882
invent.kde.org
https://invent.kde.org/pim/kmail-account-wizard/-/commit/9784f5ab41c3aff435d4a88afb25585180a62ee4
invent.kde.org
https://invent.kde.org/pim/kmail/-/tags
kde.org
https://kde.org/announcements/megarelease/6/
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/05/msg00048.html
More from Kmail
8.1
CVE-2016-7967
KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled
7.5
CVE-2017-9604
KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the…
7.3
CVE-2016-7966
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer
6.5
CVE-2020-15954
KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use
6.5
CVE-2020-11880
An issue was discovered in KDE KMail before 19.12.3