CVE-2001-0990 json
Inter7 vpopmail 4.10.35 and earlier, when using the MySQL module, compiles authentication information in cleartext into the libvpopmail.a l…
published 2001-09-04 25 y ago modified 2026-06-16 4 mo ago also EUVD-2001-0972
- cvss
- 4.6
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
Inter7 vpopmail 4.10.35 and earlier, when using the MySQL module, compiles authentication information in cleartext into the libvpopmail.a library, which allows local users to obtain the MySQL username and password by inspecting the vpopmail programs that use the library.
Patch / fix
- securityfocus.com/archive/1/212036 advisory
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
References
-
securityfocus.com
/archive/1/212036
mailing-list, patch, vendor-advisory
-
securityfocus.com
/bid/3284
vdb-entry, vendor-advisory
- inter7.com /vpopmail/ChangeLog
-
exchange.xforce.ibmcloud.com
/vulnerabilities/7076
vdb-entry
Sources
- CVE List CVE-2001-0990
- NVD CVE-2001-0990
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.