Nextcloud · Report #803734
Mail does not verify IMAP/SMTP host connected via TLS
Validstatus
mediumseverity
9upvotes
3 Jun 2020disclosed
How it was found
The Mail app should verify that the servers it connects to are listed in the certificate's CN. Otherwise the connection should be aborted.
Originally reported at https://github.com/nextcloud/mail/issues/308
Impact
The app could be forced into connecting to an insecure server.