CVE-2020-15954

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI...

6.5 MediumFix available

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.65%Unchanged since Apr 14, 2021

What each source reports

NVD Score used 6.5

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.

Record: CVE-2020-15954
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness: CWE-319
Updated: 2026-11-02

CVE List No score

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.

Record: CVE-2020-15954
Updated: 2026-11-02

EUVDEUVD-2020-7925 No score

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.

Record: EUVD-2020-7925
Updated: 2026-11-03

GitHub AdvisoriesGHSA-92g9-cf99-2j4r No score

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI...

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.

Record: GHSA-92g9-cf99-2j4r
Updated: 2026-11-02

OSV 6.5

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.

Record: CVE-2020-15954
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2020-15954 6.5

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.

Record: DEBIAN-CVE-2020-15954
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-15954 6.5

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.

Record: UBUNTU-CVE-2020-15954
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVMGASA-2020-0346 No score

Updated kdepim-runtime and kmail-account-wizard packages fix security vulnerability

It was discovered that there was an issue where kmail would default to using unencrypted POP3 communication despite the UI indicating that encryption was in use (CVE-2020-15954).

Record: MGASA-2020-0346
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`kdepim-runtime` Debian:12	before 4:20.04.1-2	4:20.04.1-2
`kdepim-runtime` Debian:13	before 4:20.04.1-2	4:20.04.1-2
`kdepim-runtime` Debian:14	before 4:20.04.1-2	4:20.04.1-2
`kmail-account-wizard` Debian:12	before 4:20.04.1-2	4:20.04.1-2
`kmail-account-wizard` Debian:13	before 4:20.04.1-2	4:20.04.1-2
`kmail-account-wizard` Debian:14	before 4:20.04.1-2	4:20.04.1-2
`ksmtp` Debian:12	before 21.12.3-2	21.12.3-2
`ksmtp` Debian:13	before 21.12.3-2	21.12.3-2
`ksmtp` Debian:14	before 21.12.3-2	21.12.3-2
`kdepim-runtime` Debian:9	before 4:16.04.2-2+deb9u1, plus listed versions 4:16.04.2-2	4:16.04.2-2+deb9u1

Show 17 moreShow less

Affected packages
Package	Affected	Fixed
`kmail-account-wizard` Mageia:7	before 19.04.0-1.1.mga7	19.04.0-1.1.mga7
`kdepim-runtime` Mageia:7	before 19.04.0-1.2.mga7	19.04.0-1.2.mga7
`kdepim-runtime` Ubuntu:16.04:LTS	All versions, plus listed versions 4:15.08.2-0ubuntu14:15.12.1-3~ubuntu34:15.12.3-0ubuntu1	None known
`kdepim-runtime` Ubuntu:18.04:LTS	All versions, plus listed versions 4:17.04.3-0ubuntu14:17.08.3-0ubuntu34:17.08.3-0ubuntu44:17.12.2-0ubuntu34:17.12.3-0ubuntu14:17.12.3-0ubuntu2	None known
`kmail-account-wizard` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 4:17.04.3-0ubuntu14:17.08.3-0ubuntu14:17.12.2-0ubuntu14:17.12.3-0ubuntu14:17.12.3-0ubuntu1+esm1	None known
`kdepim-runtime` Ubuntu:20.04:LTS	All versions, plus listed versions 4:19.04.3-0ubuntu14:19.04.3-0ubuntu24:19.12.3-0ubuntu1	None known
`kmail-account-wizard` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 4:19.04.3-0ubuntu14:19.04.3-0ubuntu24:19.12.3-0ubuntu14:19.12.3-0ubuntu1+esm1	None known
`kdepim-runtime` Ubuntu:22.04:LTS	All versions, plus listed versions 4:21.08.1-0ubuntu14:21.08.3-0ubuntu14:21.11.80-0ubuntu14:21.11.90-0ubuntu14:21.12.0-0ubuntu1 Show 4 moreShow less 4:21.12.0-0ubuntu24:21.12.1-0ubuntu14:21.12.2-0ubuntu14:21.12.3-0ubuntu1	None known
`kmail-account-wizard` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 4:21.08.1-0ubuntu14:21.08.3-0ubuntu14:21.11.80-0ubuntu14:21.11.90-0ubuntu14:21.12.0-0ubuntu1 Show 4 moreShow less 4:21.12.1-0ubuntu14:21.12.2-0ubuntu14:21.12.3-0ubuntu14:21.12.3-0ubuntu1+esm1	None known
`kdepim-runtime` Ubuntu:24.04:LTS	All versions, plus listed versions 4:23.08.1-0ubuntu14:23.08.2-0ubuntu14:23.08.3-0ubuntu14:23.08.4-0ubuntu14:23.08.5-0ubuntu14:23.08.5-0ubuntu24:23.08.5-0ubuntu3	None known
`kmail-account-wizard` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 4:23.08.1-0ubuntu14:23.08.2-0ubuntu14:23.08.3-0ubuntu14:23.08.4-0ubuntu14:23.08.5-0ubuntu14:23.08.5-0ubuntu24:23.08.5-0ubuntu34:23.08.5-0ubuntu3+esm1	None known
`kdepim-runtime` Ubuntu:25.10	All versions, plus listed versions 4:24.12.3-0ubuntu14:25.04.1-0ubuntu14:25.04.2-0ubuntu14:25.04.3-0ubuntu14:25.07.80-0ubuntu14:25.07.90-0ubuntu14:25.08.0-0ubuntu14:25.08.1-0ubuntu1	None known
`kmail-account-wizard` Ubuntu:25.10	All versions, plus listed versions 4:24.12.3-0ubuntu14:25.04.1-0ubuntu14:25.04.2-0ubuntu14:25.04.3-0ubuntu14:25.07.80-0ubuntu14:25.07.90-0ubuntu14:25.08.0-0ubuntu14:25.08.1-0ubuntu1	None known
`kdepim-runtime` Ubuntu:26.10	All versions, plus listed versions 4:25.12.3-0ubuntu14:26.04.2-14:26.04.2-24:26.04.3-0ubuntu14:26.07.90-0ubuntu14:26.08.0-0ubuntu14:26.08.1-0ubuntu1	None known
`kmail-account-wizard` Ubuntu:26.10	All versions, plus listed versions 4:25.12.3-0ubuntu14:26.04.2-14:26.04.2-24:26.04.3-0ubuntu14:26.07.90-0ubuntu14:26.08.0-0ubuntu14:26.08.0-0ubuntu24:26.08.1-0ubuntu1	None known
`kdepim-runtime` Ubuntu:26.04:LTS	All versions, plus listed versions 4:25.08.1-0ubuntu14:25.08.2-0ubuntu14:25.08.3-0ubuntu14:25.11.80-0ubuntu14:25.11.90-0ubuntu1 Show 7 moreShow less 4:25.12.0-0ubuntu14:25.12.1-0ubuntu14:25.12.1-0ubuntu24:25.12.1-0ubuntu34:25.12.1-0ubuntu44:25.12.2-0ubuntu14:25.12.3-0ubuntu1	None known
`kmail-account-wizard` Ubuntu:26.04:LTS	All versions, plus listed versions 4:25.08.1-0ubuntu14:25.08.2-0ubuntu14:25.08.3-0ubuntu14:25.11.80-0ubuntu14:25.11.90-0ubuntu1 Show 5 moreShow less 4:25.12.0-0ubuntu14:25.12.1-0ubuntu14:25.12.1-0ubuntu24:25.12.2-0ubuntu14:25.12.3-0ubuntu1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-15954 is a medium vulnerability (CVSS 6.5) in Kde Kmail, published July 27, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in kdepim-runtime 4:20.04.1-2.

References

Show 4 moreShow less