CVE-2020-24386

 

Published at: - 04-01-2021 06:15

Last modified: - 02-09-2022 05:45

Total changes: - 4

Description

An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure).

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

 

Verification logic

 

Reference

• https://dovecot.org/security
• https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html
• http://www.openwall.com/lists/oss-security/2021/01/04/4
• https://doc.dovecot.org/configuration_manual/hibernation/
• DSA-4825-Third Party Advisory
• 20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail-Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/160842/Dovecot-2.3.11.3-Access-Bypass.html
• GLSA-202101-01-Third Party Advisory
• FEDORA-2021-c90cb486f7-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2020-24386

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures