CVE-2014-2567

CVE-2014-2567 describes a vulnerability in Trojita before version 0.4.1, specifically within the OpenConnectionTask::handleStateHelper function. This flaw allows a man-in-the-middle attacker to force the use of cleartext when saving messages to sent or draft folders. The attack is initiated by a PREAUTH response that bypasses the STARTTLS command, preventing encrypted communication. The vulnerability has a CVSS score of 4.3, indicating a medium severity. It requires medium attack complexity (AC:M) and can be exploited remotely over the network (AV:N) without authentication (Au:N), leading to a potential loss of integrity (I:P) as sensitive message content could be exposed in cleartext. There is no impact on confidentiality or availability. There is no evidence of active exploitation for CVE-2014-2567, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention from researchers or the public.