CVE-2022-24732 Maddy Mail Server does not implement account expiry
Maddy Mail Server fails to enforce password or account expiry during PAM authentication, allowing access via expired credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24732?
CVE-2022-24732 is a medium-severity authentication bypass vulnerability in foxcpp maddy, published on 9 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing filtering mechanisms.
Which versions are affected by CVE-2022-24732?
2 open source packages ship an affected version, including github.com/foxcpp/maddy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/foxcpp/maddy Go | All versions | 0.5.4 |
github.com/foxcpp/maddy Go | All versions | 0.5.4 |
Products include Maddy Project Maddy.
How do I fix CVE-2022-24732?
Upgrade github.com/foxcpp/maddy to 0.5.4 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-24732 being exploited?
There is no known exploitation of CVE-2022-24732 in the wild and no public exploit code.
Other vulnerabilities in foxcpp maddy
Sources
Also known as GHSA-6cp7-g972-w9m9.