CVE-2007-6714

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-04-17 · updated 2026-06-16
Weakness: CWE-287

Description

DBMail before 2.2.9, when using authldap with an LDAP server that supports anonymous login such as Active Directory, allows remote attackers to bypass authentication via an empty password, which causes the LDAP bind to indicate success based on anonymous authentication.

Affected products

Dbmail: 2.2.6, 2.2.6-rc1, 2.2.7, 2.2.7-rc1, 2.2.7-rc2, 2.2.7-rc3 (+3)

References

http://dbmail.org/index.php?page=news&id=44
http://osvdb.org/44561
http://secunia.com/advisories/29903
http://secunia.com/advisories/29937
http://secunia.com/advisories/29984
http://www.gentoo.org/security/en/glsa/glsa-200804-24.xml
http://www.mail-archive.com/dbmail-dev%40dbmail.org/msg09942.html
http://www.securityfocus.com/bid/28849
http://www.securitytracker.com/id?1019914
http://www.vupen.com/english/advisories/2008/1321/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/41907
https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00549.html

Get alerted when CVE-2007-6714 or the next vulnerability affects your stack