CVE-2008-4491: Apple Mail

Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days.

Apple Mail.app 3.5 on Mac OS X, when "Store draft messages on the server" is enabled, stores draft copies of S/MIME email in plaintext on the email server, which allows server owners and remote man-in-the-middle attackers to read sensitive mail.

Affected products

• Apple Mail: version 3.5 only

Published 2008-10-08. Last modified 2026-06-16.