CVE-2022-24732CWE-324CWE-613

Maddy Mail Server does not implement account expiry

Medium · published March 9, 2022

CVSS v3.1
6.3
EPSS
0%
Percentile
34.1
In the wild
Unconfirmed
What it is

Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing filtering mechanisms.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00409 · 34.1th percentile
Weaknesses
CWE-324 · Use of a Key Past its Expiration Date; CWE-613 · Insufficient Session Expiration
Published
2022-03-09T19:40Z
EPSS history
Timeline
  • 09 MAR 19:40Z
    Maddy Mail Server does not implement account expiry
    cvelistv5