GHSA-9gxx-32p7-ff7m

Suggest an improvement
Source
https://github.com/advisories/GHSA-9gxx-32p7-ff7m
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-9gxx-32p7-ff7m/GHSA-9gxx-32p7-ff7m.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-9gxx-32p7-ff7m
Aliases
Published
2023-04-18T18:30:29Z
Modified
2024-09-30T21:23:44.842199Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Modoboa has Weak Password Requirements
Details

Modoboa 2.0.5 and prior allows users to set unsafe passwords, such as 1 or HACK. This issue is fixed in commit 130257c96a2392ada795785a91178e656e27015c and is part of version 2.1.0.

Database specific 
{
    "cwe_ids": [
        "CWE-521"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2023-04-18T16:15:09Z",
    "severity": "MODERATE",
    "github_reviewed_at": "2023-04-21T20:25:27Z"
}
References

Affected packages

PyPI / modoboa

Package

Name
modoboa
View open source insights on deps.dev
Purl
pkg:pypi/modoboa

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.1.0

Affected versions

0.*

0.7.0

1.*

1.2.0-rc2
1.2.0
1.2.1
1.2.2
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.5.0
1.5.1
1.5.2
1.5.3
1.6.0
1.6.1
1.6.2
1.6.3
1.7.0
1.7.1
1.7.2
1.7.3
1.7.4
1.8.0
1.8.1
1.8.2
1.8.3
1.9.0
1.9.1
1.10.0
1.10.1
1.10.2
1.10.3
1.10.4
1.10.5
1.10.6
1.10.7
1.11.0
1.11.1
1.12.0
1.12.1
1.12.2
1.13.0
1.13.1
1.14.0
1.15.0
1.16.0
1.16.1
1.17.0

2.*

2.0.0b1
2.0.0b2
2.0.0b3
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-9gxx-32p7-ff7m/GHSA-9gxx-32p7-ff7m.json"

last_known_affected_version_range

"<= 2.0.5"