Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in database connections from hMailServer.ini config file.
Weakness
The product uses a hard-coded, unchangeable cryptographic key.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Hmailserver | Hmailserver | 5.6.9-beta (including) | 5.6.9-beta (including) |
| Hmailserver | Hmailserver | 5.8.6 (including) | 5.8.6 (including) |