CVE-2007-2231 — Path Traversal in Dovecot

8 documents7 sources
Severity
4.3MEDIUMNVD
EPSS
1.1%
top 21.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
DovecotDebian Dovecot
Timeline
PublishedApr 25
Latest updateMay 1

Description

Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name.

CVSS vector

AV:N/AC:M/C:P/I:N/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/dovecot< dovecot 1.0.rc29-1 (bookworm)
▶Debiandovecot/dovecot< 1.0.rc29-1+3
▶NVDdovecot/dovecot37 versions+36

🔴Vulnerability Details

2
GHSA
GHSA-8qfr-2vxg-8g3g: Directory traversal vulnerability in index/mbox/mbox-storage↗2022-05-01
▶
OSV
CVE-2007-2231: Directory traversal vulnerability in index/mbox/mbox-storage↗2007-04-25
▶

📋Vendor Advisories

3
Ubuntu
Dovecot vulnerability↗2007-07-17
▶
Red Hat
Directory traversal in dovecot with zlib plugin↗2007-03-28
▶
Debian
CVE-2007-2231: dovecot - Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before...↗2007
▶

💬Community

2
Bugzilla
CVE-2007-2231 Directory traversal in dovecot with zlib plugin↗2007-04-30
▶
Bugzilla
CVE-2007-2231 Directory traversal in dovecot with zlib plugin↗2007-04-30
▶