Share via

Nessus Says "POP3 Cleartext Logins Permitted" in Exchange 2016 (CU17) High Vulnerability

Sathishkumar Singh 61 Reputation points
2021-02-12T08:24:48.333+00:00

Hello Support,

My Exchange Sever 2016 (CU17)
When i run Nessus tool says that "POP3 Cleartext Logins Permitted"
https://www.tenable.com/plugins/nessus/15855

How to fix this without any impact?

Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,277 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Kael Yao-MSFT 37,586 Reputation points Microsoft Vendor
    2021-02-15T03:02:30.387+00:00

    Hi, @Sathishkumar Singh

    If you don't have any users using POP3 to connect to your Exchange server(by default clients use MAPI ,Outlook Anywhere or ActiveSync to connect)
    you don't have to worry about the warning.
    You may need to disable the POP3 services on your server.
    67942-25.png

    If you would like to enable POP3 for users,please enable the POP3 services and run this command via EMS to check the authentication method: 

    Get-PopSettings -Server <servername> | Select LoginType

    It result doesn't show Securelogin(default value), use this command to change it to Securelogin: 

    Set-PopSettings -LoginType SecureLogin

    You may also need a certificate and assign it to the POP3 service.
    67981-26.png

    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.
  2. Cheong00 3,471 Reputation points
    2021-02-12T09:56:43.12+00:00

    It depends.

    If you business have no application that relies on plain text login of POP3 server (say, web applications that read replied emails and process them automatically) , then just follow action specified in the link you provided to disable plain text login.

    If yes, you'll have to modify that application to login by other authentication methods, or to use SSL port to access POP3 if supported, then disable plain text login.

    0 comments