Skip to main content

Use of an insecure channel - SMTP

Description

The configuration of the SMTP service is set to not use SSL, so confidential information traveling by this means that can be viewed without any type of encryption.

Impact

Obtain and modify confidential information sent by SMTP.

Recommendation

Deploy the application over an encrypted communication channel, use SSL secure protocols.

Threat

Unauthorized internal attacker.

Expected Remediation Time

⌚ 60 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: A
  • Attack complexity: H
  • Privileges required: N
  • User interaction: R
  • Scope: U
  • Confidentiality: L
  • Integrity: L
  • Availability: N

Temporal

  • Exploit code madurity: P
  • Remediation level: X
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:X/RC:X
  • Score:
    • Base: 3.7
    • Temporal: 3.5
  • Severity:
    • Base: Low
    • Temporal: Low

Code Examples

Compliant code

The application uses safe communication SMTP channels

public static void Test(string server){
string to = "user";
string from = "user";
MailMessage message = new MailMessage(from, to);
message.Subject = "Subject";
message.Body = @"Body";
SmtpClient client = new SmtpClient(server);
client.UseDefaultCredentials = true;
client.EnableSsl = true;
client.Send(message);
}

Non compliant code

The application uses unsafe communication SMTP channels to establish connections

public static void Test(string server) {
string to = "user";
string from = "user";
MailMessage message = new MailMessage(from, to);
message.Subject = "Subject";
message.Body = @"Body";
SmtpClient client = new SmtpClient(server);
client.UseDefaultCredentials = true;
client.EnableSsl = false;
client.Send(message);
}

Requirements