CVE-2021-38502

Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication method was configured, the MITM could obtain the authentication credentials, too. This vulnerability affects Thunderbird < 91.2.

• https://bugzilla.mozilla.org/show_bug.cgi?id=1733366Issue Tracking, Permissions Required, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2022/dsa-5034Issue Tracking, Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-47/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1733366Issue Tracking, Permissions Required, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2022/dsa-5034Issue Tracking, Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-47/Vendor Advisory

Published

Nov 3, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38497Through use of reportValidity() and window.open(), a plain-t…6.5
• CVE-2021-38498During process shutdown, a document could have caused a use-…7.5
• CVE-2021-38499Mozilla developers reported memory safety bugs present in Fi…8.8
• CVE-2021-3850Authentication Bypass by Primary Weakness in GitHub reposito…9.1
• CVE-2021-38500Mozilla developers reported memory safety bugs present in Fi…8.8
• CVE-2021-38501Mozilla developers reported memory safety bugs present in Fi…8.8
• CVE-2021-38503The iframe sandbox rules were not correctly applied to XSLT …10
• CVE-2021-38504When interacting with an HTML input element's file picker di…8.8
• CVE-2021-38505Microsoft introduced a new feature in Windows 10 known as Cl…6.5
• CVE-2021-38506Through a series of navigations, Firefox could have entered …4.3
• CVE-2021-38507The Opportunistic Encryption feature of HTTP2 (RFC 8164) all…6.5
• CVE-2021-38508By displaying a form validity message in the correct locatio…4.3