CVE-2011-1429 describes a vulnerability in the Mutt email client where it fails to properly validate the hostname of an SMTPS server against the subject of its X.509 certificate. This flaw allows man-in-the-middle attackers to spoof an SSL SMTP server using any valid certificate, affecting all versions of Mutt. With a CVSS score of 5.8, this medium-severity vulnerability could lead to information disclosure and integrity compromise (C:P/I:P) with moderate attack complexity (AC:M) and no authentication required (Au:N). There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:a:mutt:mutt:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:P/I:P/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
mutt: SSL host name check may be skipped when verifying certificate chain
Mar 8, 2011Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766.
Mar 2, 2011