VULNERABILITY INTELLIGENCE

CVE-2002-0054

CVSS score7.5 HIGH

EPSS probability22.44%

CISA KEVNot currently listed

Published2002-03-08

Last modified2026-06-16

CVSS vectorAV:N/AC:L/Au:N/C:P/I:P/A:P

Description

SMTP service in (1) Microsoft Windows 2000 and (2) Internet Mail Connector (IMC) in Exchange Server 5.5 does not properly handle responses to NTLM authentication, which allows remote attackers to perform mail relaying via an SMTP AUTH command using null session credentials.

Weakness classification

CWE-294: Authentication Bypass by Capture-replay

Primary references

cve@mitre.org — Mailing List, Third Party Advisory
cve@mitre.org — Patch, Third Party Advisory, VDB Entry
cve@mitre.org — Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory