Unscored severity · published Sep 4, 2001
CVE-2001-0990
Inter7 vpopmail 4.10.35 and earlier, when using the MySQL module, compiles authentication information in cleartext into the libvpopmail.a library, which allows local users to…
–
CVSS
0.3%
EPSS
No
On KEV
Description
Inter7 vpopmail 4.10.35 and earlier, when using the MySQL module, compiles authentication information in cleartext into the libvpopmail.a library, which allows local users to obtain the MySQL username and password by inspecting the vpopmail programs that use the library.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VP
Vpopmail · Inter7
3.4.1; 3.4.2; 3.4.3; 3.4.4; 3.4.5; 3.4.6; +12 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2001-0990
CVE.org
https://www.cve.org/CVERecord?id=CVE-2001-0990
www.inter7.com
http://www.inter7.com/vpopmail/ChangeLog
Patch
http://www.securityfocus.com/archive/1/212036
Vendor Advisory
http://www.securityfocus.com/bid/3284
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/7076
More from Vpopmail
–
CVE-2000-0091
Buffer overflow in vchkpw/vpopmail POP authentication package allows remote attackers to gain root privileges via a long username or password