CVE-2011-3372

Cyrus IMAPd < 2.4.12 - Unauthenticated Authentication Bypass via AUTHINFO USER Command

Title source: llm
STIX 2.1

Description

imap/nntpd.c in the NNTP server (nntpd) for Cyrus IMAPd 2.4.x before 2.4.12 allows remote attackers to bypass authentication by sending an AUTHINFO USER command without sending an additional AUTHINFO PASS command.

References (9)

Core 9
Core References
Various Sources x_refsource_confirm
http://cyrusimap.org/mediawiki/index.php/Latest_Updates
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=740822
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-1508.html
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2011:149
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/46093
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1026363
Vendor Advisory x_refsource_misc
http://secunia.com/secunia_research/2011-68
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2011/dsa-2318

Scores

EPSS 0.0336
EPSS Percentile 87.2%

Details

CWE
CWE-287
Status published
Products (1)
cyrus/imapd < 2.4.11
Published Dec 24, 2011
Tracked Since Feb 18, 2026