Security readout for executives and security teams
Plain-English summary
KDE KMail 19.12.3, also identified as 5.13.3, may send SMTP email in cleartext even when STARTTLS is selected, unless the account is configured with "Server requires authentication." This can expose message contents and credentials-adjacent metadata to networks that can observe mail submission traffic.
Executive priority
Treat this as a targeted confidentiality risk, not a broad infrastructure compromise. Prioritize teams using KDE KMail, especially where sensitive email is sent from unmanaged or untrusted networks.
Technical view
The issue is a client-side SMTP transport configuration flaw: KMail does not honor STARTTLS unless SMTP server authentication is enabled. The CVE source does not provide CVSS, CWE, fixed versions, or a complete affected-product table beyond the KMail version in the description.
Likely exposure
Exposure is likely limited to organizations or users running KDE KMail 19.12.3/5.13.3 with SMTP STARTTLS selected and "Server requires authentication" unchecked. Risk is higher on shared, hostile, or monitored networks where cleartext SMTP submission traffic can be observed.
Exploitation context
The source bundle does not cite active exploitation, and the CVE is not listed as KEV. Practical risk is passive interception of email traffic when vulnerable client settings cause messages to be sent without TLS.
Researcher notes
Evidence is narrow but direct: the CVE description identifies the version and configuration condition. Missing items include CVSS, CWE, authoritative fixed versions, and exploit telemetry. Do not assume other KDE Mail versions are affected without vendor confirmation.
Mitigation direction
- Review KDE vendor guidance and the linked bug for fixed-version information.
- Enable "Server requires authentication" where appropriate for affected SMTP accounts.
- Prefer authenticated SMTP submission with TLS enforced by server policy.
- Upgrade KMail if KDE identifies a corrected release.
- Avoid sending sensitive mail from affected configurations until validated.
Validation and detection
- Inventory endpoints using KDE KMail 19.12.3 or 5.13.3.
- Review SMTP account settings for STARTTLS and authentication configuration.
- Confirm whether outgoing mail submission negotiates TLS in a controlled test.
- Check mail server logs for cleartext SMTP submissions from KMail clients.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-38373 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://nostarttls.secvuln.info/CVE reference · x_refsource_MISC
- https://bugs.kde.org/show_bug.cgi?id=423423CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.