CVE-2022-24732

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing filtering mechanisms.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-324 CWE-613

Affected software

Vendor	Product	Versions
foxcpp	maddy	< 0.5.4

References

https://github.com/foxcpp/maddy/commit/7ee6a39c6a1939b376545f030a5efd6f90913583Patch, Third Party Advisory
https://github.com/foxcpp/maddy/security/advisories/GHSA-6cp7-g972-w9m9Third Party Advisory
https://github.com/foxcpp/maddy/commit/7ee6a39c6a1939b376545f030a5efd6f90913583Patch, Third Party Advisory
https://github.com/foxcpp/maddy/security/advisories/GHSA-6cp7-g972-w9m9Third Party Advisory

Timeline

Published: Mar 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-247336.1Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attac CVE-2022-247347.2MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting type CVE-2022-247357.8Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with acc CVE-2022-247365.5Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted CVE-2022-247376.5HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state CVE-2022-247387.4Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain uncla CVE-2022-247396.1alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an op CVE-2022-24748.0Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands” service, which allow CVE-2022-247407.5Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could CVE-2022-247416.5Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of servic CVE-2022-247425.5Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab CVE-2022-247438.2Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the pa