4.6med
CVE-2001-13541 exploit
NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hash…
Published 25 y ago · modified 4 mo ago · JSON
CVSS
4.6
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.8%
percentile 56%
Public exploits
1
Exploit-DB
Summary
NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password.
Exploit prediction (EPSS)
0.78% probability of exploitation in the next 30 days, higher than 56% of all scored CVEs.
Exploits and detections
- EDB-21020 NetWin DMail 2.x / SurgeFTP 1.0/2.0 - Weak Password Encryption · local · 2001-07-20
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
References
- exchange.xforce.ibmcloud.com /vulnerabilities/6866 · vdb-entry, x_refsource_XF, x_transferred
- securityfocus.com /bid/3075 · vdb-entry, x_refsource_BID, x_transferred
- online.securityfocus.com /archive/1/198293 · mailing-list, x_refsource_BUGTRAQ, x_transferred
Sources
- CVE List: CVE-2001-1354
- NVD: CVE-2001-1354
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.