CVE-2000-0960

Medium

Published: 19/12/2000(UTC)Updated: 23/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

1.70%

76th percentile - higher than 76% of all known CVEs

Summary

The POP3 server in Netscape Messaging Server 4.15p1 generates different error messages for incorrect user names versus incorrect passwords. A remote attacker can determine valid users on the system and harvest email addresses for spam abuse.

Risk Assessment

Disclosure of valid usernames makes it easier for an attacker to conduct social engineering attacks or harvest email addresses for spam. The risk is moderate but can lead to abuse.

Recommendation

Update Netscape Messaging Server to a version that does not reveal differences in error messages. Implement uniform error messages for failed login attempts.

Other vulnerabilities in Netscape Messaging Server

CVE-1999-1532Medium
Netscape Messaging Server versions 3.54, 3.55, and 3.6 allow a remote attacker to cause a denial of service (memory exhaustion) via a series of long RCPT TO commands.

Original NVD description (English source)

The POP3 server in Netscape Messaging Server 4.15p1 generates different error messages for incorrect user names versus incorrect passwords, which allows remote attackers to determine valid users on the system and harvest email addresses for spam abuse.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS