CVE-2008-2784

EUVD-2008-2777
The smtp_filter function in spamdyke before 3.1.8 does not filter RCPT commands after encountering the first DATA command, which allows remote attackers to use the server as an open mail relay by sending RCPT commands with invalid recipients, followed by a DATA command, followed by arbitrary RCPT commands and a second DATA command.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.4 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 68%
Affected Products (NVD)
VendorProductVersion
spamdykespamdyke
3.0.0
spamdykespamdyke
3.0.1
spamdykespamdyke
3.1.0
spamdykespamdyke
3.1.1
spamdykespamdyke
3.1.2
spamdykespamdyke
3.1.3
spamdykespamdyke
3.1.4
spamdykespamdyke
3.1.5
spamdykespamdyke
3.1.6
spamdykespamdyke
3.1.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://secunia.com/advisories/30408
http://www.spamdyke.org/documentation/Changelog.txt
http://www.vupen.com/english/advisories/2008/1684/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/42658
http://secunia.com/advisories/30408
http://www.spamdyke.org/documentation/Changelog.txt
http://www.vupen.com/english/advisories/2008/1684/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/42658