CVE-2009-3897: Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user…

PriorityP423medium5.5CVSS 3.1

AVLACLPRLUINSUCHINAN

EPSS

0.38%

30.1th percentile

Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	dovecot	< dovecot 1:1.2.8-1 (bookworm)	dovecot 1:1.2.8-1 (bookworm)
dovecot	dovecot	>= 0 < 1:1.2.8-1	1:1.2.8-1
dovecot	dovecot	>= 0 < 1:1.2.8-1	1:1.2.8-1
dovecot	dovecot	>= 0 < 1:1.2.8-1	1:1.2.8-1
dovecot	dovecot	>= 0 < 1:1.2.8-1	1:1.2.8-1
dovecot	dovecot	>= 1.2.0 < 1.2.8	1.2.8

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P

osv5.5MEDIUM

vendor_debian5.5MEDIUM

vendor_redhat5.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.