[原文]vpopmail 5.4.14 and 5.4.15, with cleartext passwords enabled, allows remote attackers to authenticate to an account that does not have a cleartext password set by using a blank password to (1) SMTP AUTH or (2) APOP.
Loss of Confidentiality
vpopmail contains a flaw that may allow a malicious user to bypass certain security restrictions. The issue is triggered due to an error within the handling of SMTP AUTH and APOP password authentication. It is possible that the flaw may allow an attacker to authenticate to the mail server using a blank password resulting in a loss of confidentiality.
Upgrade to version 5.4.16 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.