Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in database connections from hMailServer.ini config file.
The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Hmailserver | Hmailserver | 5.6.9-beta (including) | 5.6.9-beta (including) |
| Hmailserver | Hmailserver | 5.8.6 (including) | 5.8.6 (including) |