CVE-2002-2326

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2002-12-31 · updated 2026-06-16
Weakness: CWE-310

Description

The default configuration of Mail.app in Mac OS X 10.0 through 10.0.4 and 10.1 through 10.1.5 sends iDisk authentication credentials in cleartext when connecting to Mac.com, which could allow remote attackers to obtain passwords by sniffing network traffic.

Affected products

macOS: 10.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.1 (+5)

References

http://archives.neohapsis.com/archives/bugtraq/2002-07/0276.html
http://archives.neohapsis.com/archives/bugtraq/2002-07/0281.html
http://www.iss.net/security_center/static/9670.php
http://www.securityfocus.com/bid/5303
http://archives.neohapsis.com/archives/bugtraq/2002-07/0276.html
http://archives.neohapsis.com/archives/bugtraq/2002-07/0281.html
http://www.iss.net/security_center/static/9670.php
http://www.securityfocus.com/bid/5303

Get alerted when CVE-2002-2326 or the next vulnerability affects your stack