CVE-2011-3372
NONE EPSS 87.3%
Published Dec 24, 201114y ago · Modified Jun 16, 20262w ago
Published Dec 24, 2011 14y ago
Last Modified Jun 16, 2026 2w ago
Description
imap/nntpd.c in the NNTP server (nntpd) for Cyrus IMAPd 2.4.x before 2.4.12 allows remote attackers to bypass authentication by sending an AUTHINFO USER command without sending an additional AUTHINFO PASS command.
Threat Intelligence
EPSS Exploit Probability
87.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-287 Improper Authentication Authentication
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| cyrus | imapd | * | ≤2.4.11 |
References 9
- cyrusimap.org http://cyrusimap.org/mediawiki/index.php/Latest_Updates
- git.cyrusimap.org http://git.cyrusimap.org/cyrus-imapd/commit/?id=77903669e04c9788460561dd0560b9c916519594
- secunia.com http://secunia.com/advisories/46093
- secunia.com http://secunia.com/secunia_research/2011-68
- securitytracker.com http://securitytracker.com/id?1026363
- debian.org http://www.debian.org/security/2011/dsa-2318
- mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2011:149
- redhat.com http://www.redhat.com/support/errata/RHSA-2011-1508.html
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=740822
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.