CVE-2023-27582

CRITICAL EPSS 59.0%
Published Mar 13, 20233y ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Mar 13, 2023 3y ago
Last Modified Jun 17, 2026 2w ago

Description

maddy is a composable, all-in-one mail server. Starting with version 0.2.0 and prior to version 0.6.3, maddy allows a full authentication bypass if SASL authorization username is specified when using the PLAIN authentication mechanisms. Instead of validating the specified username, it is accepted as is after checking the credentials for the authentication username. maddy 0.6.3 includes the fix for the bug. There are no known workarounds.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
59.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-287 Improper Authentication Authentication
CWE-305

Affected Products 1

VendorProductVersionRange
maddy_projectmaddy*≥0.2.0  –  <0.6.3

References 4

  • github.com https://github.com/foxcpp/maddy/commit/55a91a37b71210f34f98f4d327c30308fe24399a
    Patch
  • github.com https://github.com/foxcpp/maddy/commit/9f58cb64b39cdc01928ec463bdb198c4c2313a9c
    Patch
  • github.com https://github.com/foxcpp/maddy/releases/tag/v0.6.3
    Release Notes
  • github.com https://github.com/foxcpp/maddy/security/advisories/GHSA-4g76-w3xw-2x6w
    PatchVendor Advisory

Remediation

  • github.com https://github.com/foxcpp/maddy/commit/55a91a37b71210f34f98f4d327c30308fe24399a
    Patch
  • github.com https://github.com/foxcpp/maddy/commit/9f58cb64b39cdc01928ec463bdb198c4c2313a9c
    Patch
  • github.com https://github.com/foxcpp/maddy/security/advisories/GHSA-4g76-w3xw-2x6w
    PatchVendor Advisory