CVE-2024-49393

MediumCVSS 6.5/10Last modified Nov 5, 2026

Description

In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-347

Affected software

VendorProductVersions
———
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—

References

Timeline

Published
Nov 12, 2024
Last modified
Nov 5, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-493945.3In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrCVE-2024-493955.3In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from theCVE-2024-493968.7The affected product is vulnerable due to insufficiently protected credentials, which may allow an attacker to impersonate Elvaco and send fCVE-2024-493979.2The affected product is vulnerable to a cross-site scripting attack which may allow an attacker to bypass authentication and takeover admin CVE-2024-493988.8The affected product is vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute code.CVE-2024-493998.7The affected product is vulnerable to an attacker being able to use commands without providing a password which may allow an attacker to leaCVE-2024-49406.1An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redireCVE-2024-494009.8Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and argumCVE-2024-494017.1Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attackers to launch privileged activities.CVE-2024-494024.6Improper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers to access data across multiple user profilesCVE-2024-494034.6Improper access control in Samsung Voice Recorder prior to version 21.5.40.37 allows physical attackers to access recording files on the locCVE-2024-494044.6Improper Access Control in Samsung Video Player prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android