VulnerabilityModified
CVE-2006-2414
Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command.
MEDIUM 5.0EPSS 2.39%
Does this matter?
Lower severity and a low EPSS score (2.39%). Track it; it rarely justifies an emergency change on its own.
Description
Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 2.39% probability · 83th percentile
- CISA KEV
- Not listed
- Affected
- timo sirainen/dovecot
- Source
- cve@mitre.org
References
- http://dovecot.org/list/dovecot-cvs/2006-May/005563.html
- http://secunia.com/advisories/20308
- http://secunia.com/advisories/20315
- http://securityreason.com/securityalert/913
- http://www.debian.org/security/2006/dsa-1080
- http://www.dovecot.org/list/dovecot-news/2006-May/000006.htmlPatch
- http://www.securityfocus.com/archive/1/433878/100/0/threaded
- http://www.securityfocus.com/bid/17961Patch
- http://www.vupen.com/english/advisories/2006/2013
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26536
- http://dovecot.org/list/dovecot-cvs/2006-May/005563.html
- http://secunia.com/advisories/20308
- http://secunia.com/advisories/20315
- http://securityreason.com/securityalert/913
- http://www.debian.org/security/2006/dsa-1080
- http://www.dovecot.org/list/dovecot-news/2006-May/000006.htmlPatch
- http://www.securityfocus.com/archive/1/433878/100/0/threaded
- http://www.securityfocus.com/bid/17961Patch
- http://www.vupen.com/english/advisories/2006/2013
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26536
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.