Unscored severity · published Dec 24, 2011
CVE-2011-3372
imap/nntpd.c in the NNTP server (nntpd) for Cyrus IMAPd 2.4.x before 2.4.12 allows remote attackers to bypass authentication by sending an AUTHINFO USER command without sending an…
–
CVSS
3.3%
EPSS
No
On KEV
Description
imap/nntpd.c in the NNTP server (nntpd) for Cyrus IMAPd 2.4.x before 2.4.12 allows remote attackers to bypass authentication by sending an AUTHINFO USER command without sending an additional AUTHINFO PASS command.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Imapd · Cyrus
through 2.4.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-3372
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-3372
cyrusimap.org
http://cyrusimap.org/mediawiki/index.php/Latest_Updates
git.cyrusimap.org
http://git.cyrusimap.org/cyrus-imapd/commit/?id=77903669e04c9788460561dd0560b9c916519594
Vendor Advisory
http://secunia.com/advisories/46093
Vendor Advisory
http://secunia.com/secunia_research/2011-68
securitytracker.com
http://securitytracker.com/id?1026363
www.debian.org
http://www.debian.org/security/2011/dsa-2318
More from Imapd
–
CVE-2006-2502
Stack-based buffer overflow in pop3d in Cyrus IMAPD (cyrus-imapd) 2.3.2, when the popsubfolders option is enabled, allows remote attackers to execute arbitrary code via a long…
–
CVE-2005-0546
Multiple buffer overflows in Cyrus IMAPd before 2.2.11 may allow attackers to execute arbitrary code via (1) an off-by-one error in the imapd annotate extension, (2) an off-by-one…