CVE-2008-2049

E-Post Mail Server 4.10 - Unauthenticated Sensitive Information Exposure via APOP Command

Title source: llm

Description

The POP3 server (EPSTPOP3S.EXE) 4.22 in E-Post Mail Server 4.10 allows remote attackers to obtain sensitive information via multiple crafted APOP commands for a known POP3 account, which displays the password in a POP3 error message.

References (7)

Core 7

Core References

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/29990

Various Sources x_refsource_misc

http://vuln.sg/epostmailserver410-en.html

Various Sources x_refsource_confirm

http://www.e-postinc.jp/Mail_Server.html

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/1389/references

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1019930

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/42035

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/28951

Scores

EPSS 0.0131

EPSS Percentile 67.3%

Details

CWE

CWE-200

Status published

Products (2)

e-post_corporation/mail_server 4.10

e-post_corporation/mail_server enterprise_4.10

Published May 01, 2008

Tracked Since Feb 18, 2026