VulnerabilityModified
CVE-2022-24732
Maddy Mail Server is an open source SMTP compatible email server.
HIGH 8.8EPSS 0.41%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing filtering mechanisms.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.41% probability · 34th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-324, CWE-613
- Affected
- maddy project/maddy
- Source
- security-advisories@github.com
References
- https://github.com/foxcpp/maddy/commit/7ee6a39c6a1939b376545f030a5efd6f90913583Patch, Third Party Advisory
- https://github.com/foxcpp/maddy/security/advisories/GHSA-6cp7-g972-w9m9Third Party Advisory
- https://github.com/foxcpp/maddy/commit/7ee6a39c6a1939b376545f030a5efd6f90913583Patch, Third Party Advisory
- https://github.com/foxcpp/maddy/security/advisories/GHSA-6cp7-g972-w9m9Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.