CVE-2010-3707
- State
- Published
- Severity
- Not scored
- Published
- Oct 6, 2010
- Updated
- Aug 7, 2024
- Reserved
- Oct 1, 2010
Description
plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving more specific entries that occur after less specific entries, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [oss-security] 20101004 Re: CVE Request: more dovecot ACL issuesmailing-list
- USN-1059-1vendor-advisory
- SUSE-SR:2010:020vendor-advisory
- ADV-2010-2572vdb-entry
- [oss-security] 20101004 CVE Request: more dovecot ACL issuesmailing-list
- MDVSA-2010:217vendor-advisory
- 43220third-party-advisory
- ADV-2011-0301vdb-entry
- [dovecot] 20101002 v1.2.15 releasedmailing-list
- [dovecot] 20101002 ACL handling bugs in v1.2.8+ and v2.0mailing-list
- RHSA-2011:0600vendor-advisory
- ADV-2010-2840vdb-entry
- [dovecot] 20101002 v2.0.5 releasedmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.