6.8

CVE-2007-6714

DBMail before 2.2.9, when using authldap with an LDAP server that supports anonymous login such as Active Directory, allows remote attackers to bypass authentication via an empty password, which causes the LDAP bind to indicate success based on anonymous authentication.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dbmail ≫ Dbmail Version2.2.6
Dbmail ≫ Dbmail Version2.2.6 Updaterc1
Dbmail ≫ Dbmail Version2.2.7
Dbmail ≫ Dbmail Version2.2.7 Updaterc1
Dbmail ≫ Dbmail Version2.2.7 Updaterc2
Dbmail ≫ Dbmail Version2.2.7 Updaterc3
Dbmail ≫ Dbmail Version2.2.7 Updaterc4
Dbmail ≫ Dbmail Version2.2.8
Dbmail ≫ Dbmail Version2.2.8 Updaterc1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.44% 0.788
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.