CVE-2007-6714

Published Apr 17, 2008

Last updated 11 days ago

Overview

Description
DBMail before 2.2.9, when using authldap with an LDAP server that supports anonymous login such as Active Directory, allows remote attackers to bypass authentication via an empty password, which causes the LDAP bind to indicate success based on anonymous authentication.
Source
cve@mitre.org
NVD status
Deferred

Risk scores

CVSS 2.0

Type
Primary
Base score
6.8
Impact score
6.4
Exploitability score
8.6
Vector string
AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov
CWE-287

Social media

Hype score
Not currently trending

Configurations