5.5

CVE-2010-3706

plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving the private namespace of a user, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.

Data is provided by the National Vulnerability Database (NVD)
Dovecot ≫ Dovecot Version1.2.0
Dovecot ≫ Dovecot Version1.2.1
Dovecot ≫ Dovecot Version1.2.2
Dovecot ≫ Dovecot Version1.2.3
Dovecot ≫ Dovecot Version1.2.4
Dovecot ≫ Dovecot Version1.2.5
Dovecot ≫ Dovecot Version1.2.6
Dovecot ≫ Dovecot Version1.2.7
Dovecot ≫ Dovecot Version1.2.8
Dovecot ≫ Dovecot Version1.2.9
Dovecot ≫ Dovecot Version1.2.10
Dovecot ≫ Dovecot Version1.2.11
Dovecot ≫ Dovecot Version1.2.12
Dovecot ≫ Dovecot Version1.2.13
Dovecot ≫ Dovecot Version1.2.14
Dovecot ≫ Dovecot Version2.0.0
Dovecot ≫ Dovecot Version2.0.1
Dovecot ≫ Dovecot Version2.0.2
Dovecot ≫ Dovecot Version2.0.3
Dovecot ≫ Dovecot Version2.0.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.4% 0.579
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.5 8 4.9
AV:N/AC:L/Au:S/C:P/I:P/A:N