Modoboa has Weak Password Requirements

CRITICAL 9.8CVE-2023-2160 · GHSA-9gxx-32p7-ff7m · PYSEC-2023-34 · Published 18/04/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
modoboa PyPI	`< 2.1.0`	`2.1.0`
modoboa modoboa	`< 2.1.0`	`2.1.0`

Description

Modoboa 2.0.5 and prior allows users to set unsafe passwords, such as 1 or HACK. This issue is fixed in commit 130257c96a2392ada795785a91178e656e27015c and is part of version 2.1.0.

NVD description

Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.

References

nvd.nist.gov/vuln/detail/CVE-2023-2160 · ADVISORY
modoboa/modoboa commit 130257c · WEB
modoboa/modoboa · PACKAGE
pypa/advisory-database · WEB
huntr.dev/bounties/54fb6d6a-6b39-45b6-b62a-930260ba484b · WEB
GitHub Advisory GHSA-9gxx-32p7-ff7m · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free