CVE-2008-2784

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-06-19 · updated 2026-06-16
Weakness: CWE-264

Description

The smtp_filter function in spamdyke before 3.1.8 does not filter RCPT commands after encountering the first DATA command, which allows remote attackers to use the server as an open mail relay by sending RCPT commands with invalid recipients, followed by a DATA command, followed by arbitrary RCPT commands and a second DATA command.

Affected products

spamdyke: 3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.1.2, 3.1.3 (+4)

References

http://secunia.com/advisories/30408
http://www.spamdyke.org/documentation/Changelog.txt
http://www.vupen.com/english/advisories/2008/1684/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/42658
http://secunia.com/advisories/30408
http://www.spamdyke.org/documentation/Changelog.txt
http://www.vupen.com/english/advisories/2008/1684/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/42658

Get alerted when CVE-2008-2784 or the next vulnerability affects your stack