Vulnerability Description
The POP3 service for WebEasyMail 3.4.2.2 and earlier generates diffferent error messages for valid and invalid usernames during authentication, which makes it easier for remote attackers to conduct brute force attacks.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Webeasymail | Webeasymail | <= 3.4.2.2 |
References
- http://online.securityfocus.com/archive/1/288222ExploitVendor Advisory
- http://www.iss.net/security_center/static/9925.phpVendor Advisory
- http://www.securityfocus.com/bid/5519Vendor Advisory
- http://online.securityfocus.com/archive/1/288222ExploitVendor Advisory
- http://www.iss.net/security_center/static/9925.phpVendor Advisory
- http://www.securityfocus.com/bid/5519Vendor Advisory
FAQ
What is CVE-2002-1416?
CVE-2002-1416 is a vulnerability with a CVSS score of 5.0 (MEDIUM). The POP3 service for WebEasyMail 3.4.2.2 and earlier generates diffferent error messages for valid and invalid usernames during authentication, which makes it easier for remote attackers to conduct br...
How severe is CVE-2002-1416?
CVE-2002-1416 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2002-1416?
Check the references section above for vendor advisories and patch information. Affected products include: Webeasymail Webeasymail.