Threats tagged 'ghsa-8r4c-2qx7-2q6q'

Progressive Robot hMailServer versions 6.3.3 through 6.3.7 have a vulnerability in the web services listener where it does not enforce the server's IP range restrictions. This allows remote unauthenticated attackers to continue guessing account passwords via the listener's sign-in interface even after their IP address has been banned by the auto-ban mechanism on other protocols. The listener is off by default and uses HTTP Basic authentication over HTTPS for CardDAV, CalDAV, and Outlook Autodiscover services. The auto-ban mechanism does not apply to this listener, enabling repeated failed login attempts from banned IPs or IPs restricted by administrator policies. The flaw is exacerbated when the listener is behind a TLS-terminating proxy, which causes bans to be ineffective because the listener sees only the proxy's IP address. A separate defect in per-account lockout was fixed in the same release. The CVSS score is 5.3 (medium severity).