Vulnerability Database

296,335

Total vulnerabilities in the database

CVE-2007-6714

DBMail before 2.2.9, when using authldap with an LDAP server that supports anonymous login such as Active Directory, allows remote attackers to bypass authentication via an empty password, which causes the LDAP bind to indicate success based on anonymous authentication.

Published: Apr 18, 2008
Updated: Nov 8, 2023
CVE: CVE-2007-6714
Severity: Medium
Exploit:

CVSS v2:

Severity: Medium
Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

CWE-287

OWASP TOP 10:

A2 - Broken Authentication

Affected Software
References

Software	From	Fixed in
dbmail / dbmail	2.2.7-rc3	2.2.7-rc3.x
dbmail / dbmail	2.2.7-rc1	2.2.7-rc1.x
dbmail / dbmail	2.2.7-rc2	2.2.7-rc2.x
dbmail / dbmail	2.2.6	2.2.6.x
dbmail / dbmail	2.2.7	2.2.7.x
dbmail / dbmail	2.2.6-rc1	2.2.6-rc1.x
dbmail / dbmail	2.2.8	2.2.8.x
dbmail / dbmail	2.2.8-rc1	2.2.8-rc1.x
dbmail / dbmail	2.2.7-rc4	2.2.7-rc4.x