CVE-2011-3372

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-12-24 · updated 2026-06-16
Weakness: CWE-287

Description

imap/nntpd.c in the NNTP server (nntpd) for Cyrus IMAPd 2.4.x before 2.4.12 allows remote attackers to bypass authentication by sending an AUTHINFO USER command without sending an additional AUTHINFO PASS command.

Affected products

Cyrus Imapd: through 2.4.11

References

http://cyrusimap.org/mediawiki/index.php/Latest_Updates
http://git.cyrusimap.org/cyrus-imapd/commit/?id=77903669e04c9788460561dd0560b9c916519594
http://secunia.com/advisories/46093
http://secunia.com/secunia_research/2011-68
http://securitytracker.com/id?1026363
http://www.debian.org/security/2011/dsa-2318
http://www.mandriva.com/security/advisories?name=MDVSA-2011:149
http://www.redhat.com/support/errata/RHSA-2011-1508.html
https://bugzilla.redhat.com/show_bug.cgi?id=740822
http://cyrusimap.org/mediawiki/index.php/Latest_Updates
http://git.cyrusimap.org/cyrus-imapd/commit/?id=77903669e04c9788460561dd0560b9c916519594
http://secunia.com/advisories/46093

Get alerted when CVE-2011-3372 or the next vulnerability affects your stack