CVE-2004-2313: Medium severity inter7 sqwebmail vulnerability

Published Dec 31, 2004

Updated

Inter7 SqWebMail 3.4.1 through 3.6.1 generates different error messages for incorrect passwords versus correct passwords on non-mail-enabled accounts (such as root), which allows remote attackers to guess the root password via brute force attacks.

Affected Software

7 affected components

Inter7 SqWebMail=3.4.1

Inter7 SqWebMail=3.5.0

Inter7 SqWebMail=3.5.1

Inter7 SqWebMail=3.5.2

Inter7 SqWebMail=3.5.3

Inter7 SqWebMail=3.6.0

Inter7 SqWebMail=3.6.1

Event History

Dec 31, 2004

CVE Published

05:00 AM

Aug 16, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-2313?

CVE-2004-2313 is considered a high severity vulnerability due to its potential for remote exploitation through brute force attacks.

How do I fix CVE-2004-2313?

To fix CVE-2004-2313, upgrade to a version of Inter7 SqWebMail that is not affected, specifically versions beyond 3.6.1.

What systems are affected by CVE-2004-2313?

CVE-2004-2313 affects Inter7 SqWebMail versions from 3.4.1 to 3.6.1.

What type of attack does CVE-2004-2313 facilitate?

CVE-2004-2313 facilitates brute force attacks on non-mail-enabled accounts by revealing different responses based on password correctness.

Is CVE-2004-2313 related to user authentication?

Yes, CVE-2004-2313 is directly related to user authentication vulnerabilities that allow attackers to exploit incorrect password handling.