CVE-2002-2043: Cyrus Sasl

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

SQL injection vulnerability in the LDAP and MySQL authentication patch for Cyrus SASL 1.5.24 and 1.5.27 allows remote attackers to execute arbitrary SQL commands and log in as arbitrary POP mail users via the password.

Affected products

• Cyrus Sasl: version 1.5.24 only; version 1.5.27 only

Published 2002-12-31. Last modified 2026-06-16.