CVE-2007-1137 json
putmail.py in Putmail before 1.4 does not detect when a user attempts to use TLS with a server that does not support it, which causes putma…
published 2007-02-27 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-1134
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 60%
- public exploits
- 0
- none known
Summary
putmail.py in Putmail before 1.4 does not detect when a user attempts to use TLS with a server that does not support it, which causes putmail.py to send the username and password in plaintext while the user believes encryption is in use, and allows remote attackers to obtain sensitive information.
Exploit prediction
0.92% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
References
-
secunia.com
/advisories/24266
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2007/0753
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/32689
vdb-entry
-
securityfocus.com
/bid/22718
vdb-entry
- putmail.sourceforge.net /home.html
-
osvdb.org
/33764
vdb-entry
Sources
- CVE List CVE-2007-1137
- NVD CVE-2007-1137
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.