What’s Vulnerable › Vulnerabilities

CVE-2024-50624

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-28 · updated 2026-06-17
• Weakness: CWE-319

Description

ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is used for a URL such as http://autoconfig.example.com or http://example.com/.well-known/autoconfig for retrieving the configuration. This is related to kmail-account-wizard.

Affected products

• KDE Kmail: before 6.2.0 — fixed in 6.2.0

How to fix

Upgrade to a fixed version: KDE Kmail 6.2.0. Check the vendor advisory for mitigations.

References

• https://bugs.kde.org/show_bug.cgi?id=487882
• https://invent.kde.org/pim/kmail-account-wizard/-/commit/9784f5ab41c3aff435d4a88afb25585180a62ee4
• https://invent.kde.org/pim/kmail/-/tags
• https://kde.org/announcements/megarelease/6/
• https://lists.debian.org/debian-lts-announce/2025/05/msg00048.html

Get alerted when CVE-2024-50624 or the next vulnerability affects your stack