VulnerabilityModified
CVE-2001-0104
MDaemon Pro 3.5.1 and earlier allows local users to bypass the "lock server" security setting by pressing the Cancel button at the password prompt, then pressing the enter key.
HIGH 7.2EPSS 0.40%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.40%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
MDaemon Pro 3.5.1 and earlier allows local users to bypass the "lock server" security setting by pressing the Cancel button at the password prompt, then pressing the enter key.
- CVSS 2.0
- 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 0.40% probability · 33th percentile
- CISA KEV
- Not listed
- Affected
- alt-n/mdaemon
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/archive/1/151156
- http://www.securityfocus.com/bid/2115Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/5763
- http://www.securityfocus.com/archive/1/151156
- http://www.securityfocus.com/bid/2115Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/5763
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.