GHSA-9gxx-32p7-ff7m

Modoboa has Weak Password Requirements

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-2160

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	modoboa	< 2.1.0	2.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

Modoboa 2.0.5 and prior allows users to set unsafe passwords, such as `1` or `HACK`. This issue is fixed in commit 130257c96a2392ada795785a91178e656e27015c and is part of version 2.1.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-2160 advisory
https://github.com/modoboa/modoboa/commit/130257c96a2392ada795785a91178e656e27015c web
https://github.com/modoboa/modoboa package
https://github.com/pypa/advisory-database/tree/main/vulns/modoboa/PYSEC-2023-34.yaml web
https://huntr.dev/bounties/54fb6d6a-6b39-45b6-b62a-930260ba484b web