Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.0
CVE-2004-2313: Inter7 SqWebMail lets attackers guess passwords on non‑mail accounts
CVE-2004-2313 · published 21 years ago
Summary
The Inter7 SqWebMail versions 3.4.1 to 3.6.1 tell users whether a password is correct or not for accounts that aren’t meant for email, such as the system’s root account. This makes it possible for an outsider to try many passwords until the right one is found. Apply the latest software update or change the configuration so that all login failures return the same generic message.
What to do
- Update debian courier to version 0.44.2-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | courier |
< 0.44.2-1 Fix: upgrade to 0.44.2-1
|
| Debian:13 | debian | courier |
< 0.44.2-1 Fix: upgrade to 0.44.2-1
|
| Debian:14 | debian | courier |
< 0.44.2-1 Fix: upgrade to 0.44.2-1
|
| – | inter7 | sqwebmail |
3.4.1 3.5.0 3.5.1 3.5.2 3.5.3 3.6.0 3.6.1 cpe:2.3:a:inter7:sqwebmail:3.4.1:*:*:*:*:*:*:* |
Original advisory text
Inter7 SqWebMail 3.4.1 through 3.6.1 generates different error messages for incorrect passwords versus correct passwords on non-mail-enabled accounts (such as root), which allows remote attackers t...
Inter7 SqWebMail 3.4.1 through 3.6.1 generates different error messages for incorrect passwords versus correct passwords on non-mail-enabled accounts (such as root), which allows remote attackers to guess the root password via brute force attacks.
Severity
5.0
Medium
Timeline
Published31 Dec 2004
Updated3 Nov 2026
First seen15 Sep 2026
Track software like this
Free during beta