imap/nntpd.c in the NNTP server (nntpd) for Cyrus IMAPd 2.4.x before 2.4.12 allows remote attackers to bypass authentication by sending an AUTHINFO USER command without sending an additional AUTHINFO PASS command.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade cyrus-imapd-murderUpgrade cyrus-imapd-perlUpgrade cyrus-imapd-utilsUpgrade cyrus-imapd-develUpgrade cyrus-imapd-nntpUpgrade perl-CyrusUpgrade cyrus-imapd | Dec 1, 2016 | Dec 24, 2011 |
| Oracle_linux | — | Upgrade cyrus-imapd-develUpgrade cyrus-imapd-utilsUpgrade cyrus-imapd-perlUpgrade cyrus-imapd | Oct 16, 2024 | Dec 24, 2011 |
| Suse | — | Upgrade cyrus-imapd-develUpgrade perl-Cyrus-IMAPUpgrade perl-Cyrus-SIEVE-managesieveUpgrade cyrus-imapd | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade cyrus-imapd-2.2 | Nov 19, 2024 | Dec 24, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub