Auth bypass in Cyrus Imapd

CVE-2011-3372

imap/nntpd.c in the NNTP server (nntpd) for Cyrus IMAPd 2.4.x before 2.4.12 allows remote attackers to bypass authentication by sending an AUTHINFO USER command without sending an additional AUTHINFO PASS command.

Vulnerability class: Broken Authentication

EPSS: 0.034 (87.4th percentile) — read the EPSS interpretation.

Affected products

Weakness classification (CWE)

References