6.4med
CVE-2001-0996
POP3Lite before 0.2.4 does not properly quote a . (dot) in an email message, which could allow a remote attacker to append arbitrary text t…
Published 25 y ago · modified 4 mo ago · JSON
CVSS
6.4
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.7%
percentile 77%
Public exploits
0
none known
Summary
POP3Lite before 0.2.4 does not properly quote a . (dot) in an email message, which could allow a remote attacker to append arbitrary text to the end of an email message, which could then be interpreted by various mail clients as valid POP server responses or other input that could cause clients to crash or otherwise behave unexpectedly.
Exploit prediction (EPSS)
1.69% probability of exploitation in the next 30 days, higher than 77% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:N/I:P/A:P |
References
- exchange.xforce.ibmcloud.com /vulnerabilities/7075 · vdb-entry, x_refsource_XF, x_transferred
- securityfocus.com /bid/3278 · vdb-entry, x_refsource_BID, x_transferred
- archives.neohapsis.com /archives/bugtraq/2001-08/0436.html · mailing-list, x_refsource_BUGTRAQ, x_transferred
Sources
- CVE List: CVE-2001-0996
- NVD: CVE-2001-0996
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.