Is CVE-2021-37845 actively exploited?

No active exploitation of CVE-2021-37845 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2021-37845 be exploited remotely?

Yes. CVE-2021-37845 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2021-37845?

CVE-2021-37845 has a CVSS score of 3.7 (LOW).

HOME VULNERABILITIESCVE-2021-37845

LOW

CVE-2021-37845

NVD-CWE-noinfoPublished: May 29, 2023· Updated: Jun 17, 2026

3.7

CVSS v3.1

Official Description

An issue was discovered in Citadel through webcit-932. A meddler-in-the-middle attacker can fixate their own session during the cleartext phase before a STARTTLS command (a violation of "The STARTTLS command is only valid in non-authenticated state." in RFC2595). This potentially allows an attacker to cause a victim's e-mail messages to be stored into an attacker's IMAP mailbox, but depends on details of the victim's client behavior.

NVD Source

Technical Analysis

CVE-2021-37845 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.