Threats tagged 'ghsa-4f2q-v3rq-2852'

A vulnerability in hMailServer versions 6.2.0 through 6.3.3 using MySQL or MariaDB databases allows an attacker to bypass the auto-ban mechanism after repeated failed login attempts. This occurs because the server's auto-ban feature fails to save IP ranges when usernames contain certain UTF-8 characters outside the Basic Multilingual Plane, preventing bans from being enforced. As a result, an unauthenticated remote attacker can continue guessing passwords from a single IP address without being banned. The issue affects authentication methods using SASL PLAIN and plain-text authentication under certain configurations. Failed attempts to save bans are logged as errors. The CVSS score is 5.3 (medium severity).