CVE-2011-3372

EPSS 0.75%
Published 24.12.2011 19:55:01
Last modified 11.04.2025 00:51:21
Source secalert@redhat.com
Teams watchlist Login
Open Login

imap/nntpd.c in the NNTP server (nntpd) for Cyrus IMAPd 2.4.x before 2.4.12 allows remote attackers to bypass authentication by sending an AUTHINFO USER command without sending an additional AUTHINFO PASS command.

Affected products Warnungen 0 Metrics 2 CWE 1 References 12

Data is provided by the National Vulnerability Database (NVD)

Cyrus ≫ Imapd Version <= 2.4.11

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.75%	0.707

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://www.debian.org/security/2011/dsa-2318

http://www.mandriva.com/security/advisories?name=MDVSA-2011:149

http://www.redhat.com/support/errata/RHSA-2011-1508.html

http://cyrusimap.org/mediawiki/index.php/Latest_Updates

http://git.cyrusimap.org/cyrus-imapd/commit/?id=77903669e04c9788460561dd0560b9c916519594

http://secunia.com/advisories/46093

Vendor Advisory

http://secunia.com/secunia_research/2011-68

Vendor Advisory

http://securitytracker.com/id?1026363

https://bugzilla.redhat.com/show_bug.cgi?id=740822

https://nvd.nist.gov/vuln/detail/CVE-2011-3372

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2011-3372

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2011-3372

EUVD