Medium severity6.5NVD Advisory· Published Jun 8, 2026· Updated Jun 9, 2026

CVE-2020-37248

Description

OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to authentication, which allows STRIPTLS/man-in-the-middle attacks, taking over the connection and extracting account credentials in cleartext.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

OfflineIMAP/offlineimapllm-fuzzy
Range: <8.0.3

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2026/06/08/3nvd
github.com/OfflineIMAP/offlineimap/issues/669nvd
github.com/OfflineIMAP/offlineimap3/commit/46505c53ef995455d66c685f9ec3ff6ea93dbb74nvd
github.com/OfflineIMAP/offlineimap3/issues/222nvd
pypi.org/project/offlineimap/nvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000