← back
CVE-2007-6598

CVE-2007-6598

EPSS 2.0%
Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.
Affected products
n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://dovecot.org/list/dovecot-news/2007-December/000057.htmlhttp://dovecot.org/list/dovecot-news/2007-December/000058.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.htmlhttp://osvdb.org/39876http://secunia.com/advisories/28227http://secunia.com/advisories/28271http://secunia.com/advisories/28404http://secunia.com/advisories/28434http://secunia.com/advisories/30342http://secunia.com/advisories/32151https://issues.rpath.com/browse/RPL-2076https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10458