> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Client protocols (CP)

- URL: /taxonomies/email-infrastructure/client-protocols/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-10-29T14:52:51.155Z
- Description: Client protocols (CP): 13 threats in the email infrastructure threat taxonomy. IMAP, POP, submission, and the API protocols clients use to reach the mailbox.
- Author: Brett Crawley

[Taxonomies](/taxonomies/) › [Email infrastructure](/taxonomies/email-infrastructure/) › Client protocols

**Layer 03 of 09 · 13 threats · prefix CP**

Client access is where a mailbox is read, copied and reconfigured, so a weakness here exposes everything the rest of the platform protected. These entries cover IMAP, POP and SMTP submission, plus EWS, ActiveSync, JMAP and vendor APIs.

**Scope:** IMAP, POP, submission, and the API protocols clients use to reach the mailbox.

![Table: Client protocols (CP), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the email infrastructure taxonomy overview page.](https://www.ostering.com/media/posts/96/email-taxonomy-table-03-CP.png =1400x3985)

*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/email-infrastructure/) on the overview page, where it can be searched and copied.*

## The threats

- <span id="cp-a"></span>**CP·A** Legacy Authentication
- <span id="cp-k"></span>**CP·K** Credential Exposure in Transit
- <span id="cp-q"></span>**CP·Q** Token and Session Persistence
- <span id="cp-j"></span>**CP·J** Sync as Exfiltration
- <span id="cp-10"></span>**CP·10** Mailbox State Manipulation
- <span id="cp-9"></span>**CP·9** Credentials and Caches at Rest
- <span id="cp-8"></span>**CP·8** Autodiscovery Hijack
- <span id="cp-7"></span>**CP·7** Authentication Oracle
- <span id="cp-6"></span>**CP·6** Third-Party Delegation
- <span id="cp-5"></span>**CP·5** Cross-Mailbox Access
- <span id="cp-4"></span>**CP·4** Protocol Command Abuse
- <span id="cp-3"></span>**CP·3** Lockout as Denial of Service
- <span id="cp-2"></span>**CP·2** Notification Leakage

## Where this layer touches others

- **Operations and the other layers:** delivery pipeline, client protocols and DNS each cover a corner of operations (admin routing changes in DP·2, mailbox state in CP·10, dangling records in DN·K). Operations and storage covers the stores and tooling around the message path: the copies, the credentials and the people with access.

## STRIDE, CAPEC and CWE

Of the 13 entries here, STRIDE fits 11 cleanly and 2 only loosely. CAPEC 3.9 has a pattern that describes 5 of them directly, only a generic parent pattern for 6, and nothing for 2. CWE 4.20 names the weakness directly for 7, has only a broader weakness for 6,. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Email Threat Taxonomy to STRIDE, CAPEC and CWE](/email-threat-taxonomy-mapping). The Excel, SKOS and STIX downloads carry the same mapping as text.

![Table: STRIDE, CAPEC and CWE mapping for Client protocols (CP), 13 threats, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the email infrastructure taxonomy overview page.](https://www.ostering.com/media/posts/96/email-mapping-table-03-CP.png =1400x2333)

---

← [Authentication protocols (AU)](/taxonomies/email-infrastructure/authentication-protocols/) · [Email infrastructure overview](/taxonomies/email-infrastructure/) · [SMTP (SM)](/taxonomies/email-infrastructure/smtp/) →

*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [email infrastructure overview](/taxonomies/email-infrastructure/).*