CVE-2004-2313 Information disclosure in n/a
Remote attackers can brute-force root passwords by distinguishing error messages for valid versus invalid credentials on non-mail accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2004-2313?
CVE-2004-2313 is a medium-severity vulnerability in n/a, published on 16 Aug 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Inter7 SqWebMail 3.4.1 through 3.6.1 generates different error messages for incorrect passwords versus correct passwords on non-mail-enabled accounts (such as root), which allows remote attackers to guess the root password via brute force attacks.
Which versions are affected by CVE-2004-2313?
It affects 1 product.
Products include Inter7 Sqwebmail.
How do I fix CVE-2004-2313?
Upgrade to a fixed version.
Is CVE-2004-2313 being exploited?
There is no known exploitation of CVE-2004-2313 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2004-2313, GHSA-w796-x29v-gcg9.