CVE-2008-4578
published 2008-10-15CVE-2008-4578: The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized…
PriorityP425medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
1.68%
74.5th percentile
The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes.
Affected
61 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | dovecot | < dovecot 1:1.1.9-1 (bookworm) | dovecot 1:1.1.9-1 (bookworm) |
| dovecot | dovecot | <= 1.1.3 | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_debian5.0LOW
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c8mg-ww68-7qfc: The ACL plugin in Dovecot before 1
ghsa_unreviewed·2022-05-02
CVE-2008-4578 [MEDIUM] GHSA-c8mg-ww68-7qfc: The ACL plugin in Dovecot before 1
The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes.
OSV
CVE-2008-4578: The ACL plugin in Dovecot before 1
osv·2008-10-15·CVSS 5.0
CVE-2008-4578 [MEDIUM] CVE-2008-4578: The ACL plugin in Dovecot before 1
The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes.
Red Hat
dovecot: bypass of the 'k' right in the ACL plugin
vendor_redhat·2008-10-05·CVSS 5.0
CVE-2008-4578 [MEDIUM] dovecot: bypass of the 'k' right in the ACL plugin
dovecot: bypass of the 'k' right in the ACL plugin
The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes.
Statement: The risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 5.
Debian
CVE-2008-4578: dovecot - The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended acces...
vendor_debian·2008·CVSS 5.0
CVE-2008-4578 [MEDIUM] CVE-2008-4578: dovecot - The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended acces...
The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes.
Scope: local
bookworm: resolved (fixed in 1:1.1.9-1)
bullseye: resolved (fixed in 1:1.1.9-1)
forky: resolved (fixed in 1:1.1.9-1)
sid: resolved (fixed in 1:1.1.9-1)
trixie: resolved (fixed in 1:1.1.9-1)
No detection rules found.
No public exploits indexed.
http://bugs.gentoo.org/show_bug.cgi?id=240409http://secunia.com/advisories/32164http://secunia.com/advisories/33149http://security.gentoo.org/glsa/glsa-200812-16.xmlhttp://www.dovecot.org/list/dovecot-news/2008-October/000085.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:232http://www.securityfocus.com/archive/1/498498/100/0/threadedhttp://www.securityfocus.com/bid/31587http://www.vupen.com/english/advisories/2008/2745https://exchange.xforce.ibmcloud.com/vulnerabilities/45669http://bugs.gentoo.org/show_bug.cgi?id=240409http://secunia.com/advisories/32164http://secunia.com/advisories/33149http://security.gentoo.org/glsa/glsa-200812-16.xmlhttp://www.dovecot.org/list/dovecot-news/2008-October/000085.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:232http://www.securityfocus.com/archive/1/498498/100/0/threadedhttp://www.securityfocus.com/bid/31587http://www.vupen.com/english/advisories/2008/2745https://exchange.xforce.ibmcloud.com/vulnerabilities/45669
2008-10-15
Published