5.8

CVE-2013-6171

checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass authentication and access virtual email accounts by attaching to the process and using a restricted file descriptor to modify account information in the response to the dovecot-auth server.

Data is provided by the National Vulnerability Database (NVD)
Dovecot ≫ Dovecot Version <= 2.2.6
Dovecot ≫ Dovecot Version2.0 Updatebeta1
Dovecot ≫ Dovecot Version2.0.0
Dovecot ≫ Dovecot Version2.0.1
Dovecot ≫ Dovecot Version2.0.2
Dovecot ≫ Dovecot Version2.0.3
Dovecot ≫ Dovecot Version2.0.4
Dovecot ≫ Dovecot Version2.0.5
Dovecot ≫ Dovecot Version2.0.6
Dovecot ≫ Dovecot Version2.0.7
Dovecot ≫ Dovecot Version2.0.8
Dovecot ≫ Dovecot Version2.0.9
Dovecot ≫ Dovecot Version2.0.10
Dovecot ≫ Dovecot Version2.0.11
Dovecot ≫ Dovecot Version2.0.12
Dovecot ≫ Dovecot Version2.0.13
Dovecot ≫ Dovecot Version2.0.14
Dovecot ≫ Dovecot Version2.0.15
Dovecot ≫ Dovecot Version2.1 Updaterc1
Dovecot ≫ Dovecot Version2.1 Updaterc2
Dovecot ≫ Dovecot Version2.1 Updaterc3
Dovecot ≫ Dovecot Version2.1 Updaterc5
Dovecot ≫ Dovecot Version2.1 Updaterc6
Dovecot ≫ Dovecot Version2.1 Updaterc7
Dovecot ≫ Dovecot Version2.1.0
Dovecot ≫ Dovecot Version2.1.1
Dovecot ≫ Dovecot Version2.1.2
Dovecot ≫ Dovecot Version2.1.3
Dovecot ≫ Dovecot Version2.1.4
Dovecot ≫ Dovecot Version2.1.5
Dovecot ≫ Dovecot Version2.1.6
Dovecot ≫ Dovecot Version2.1.7
Dovecot ≫ Dovecot Version2.1.10
Dovecot ≫ Dovecot Version2.1.11
Dovecot ≫ Dovecot Version2.1.12
Dovecot ≫ Dovecot Version2.1.13
Dovecot ≫ Dovecot Version2.1.14
Dovecot ≫ Dovecot Version2.1.15
Dovecot ≫ Dovecot Version2.2 Updaterc1
Dovecot ≫ Dovecot Version2.2 Updaterc2
Dovecot ≫ Dovecot Version2.2 Updaterc3
Dovecot ≫ Dovecot Version2.2 Updaterc4
Dovecot ≫ Dovecot Version2.2 Updaterc5
Dovecot ≫ Dovecot Version2.2 Updaterc6
Dovecot ≫ Dovecot Version2.2 Updaterc7
Dovecot ≫ Dovecot Version2.2.0
Dovecot ≫ Dovecot Version2.2.1
Dovecot ≫ Dovecot Version2.2.2
Dovecot ≫ Dovecot Version2.2.3
Dovecot ≫ Dovecot Version2.2.4
Dovecot ≫ Dovecot Version2.2.5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.25% 0.479
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:P/A:N
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.