CVEvulnerability
CVE-2011-3372
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2011-12-24
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-287
Description
imap/nntpd.c in the NNTP server (nntpd) for Cyrus IMAPd 2.4.x before 2.4.12 allows remote attackers to bypass authentication by sending an AUTHINFO USER command without sending an additional AUTHINFO PASS command.
Affected configurations
• cyrus imapd (<= 2.4.11)
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://cyrusimap.org/mediawiki/index.php/Latest_Updates cyrusimap.org
- http://git.cyrusimap.org/cyrus-imapd/commit/?id=77903669e04c9788460561dd0560b9c916519594 git.cyrusimap.org
- http://secunia.com/advisories/46093 Vendor Advisory
- http://secunia.com/secunia_research/2011-68 Vendor Advisory
- http://securitytracker.com/id?1026363 securitytracker.com
- http://www.debian.org/security/2011/dsa-2318 www.debian.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:149 www.mandriva.com
- http://www.redhat.com/support/errata/RHSA-2011-1508.html www.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=740822 bugzilla.redhat.com
- http://cyrusimap.org/mediawiki/index.php/Latest_Updates cyrusimap.org
- http://git.cyrusimap.org/cyrus-imapd/commit/?id=77903669e04c9788460561dd0560b9c916519594 git.cyrusimap.org
- http://secunia.com/advisories/46093 Vendor Advisory
- http://secunia.com/secunia_research/2011-68 Vendor Advisory
- http://securitytracker.com/id?1026363 securitytracker.com
- http://www.debian.org/security/2011/dsa-2318 www.debian.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:149 www.mandriva.com
- http://www.redhat.com/support/errata/RHSA-2011-1508.html www.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=740822 bugzilla.redhat.com