CVE-2022-30550 — Improper Authentication in Dovecot
Severity
8.8HIGHNVD
EPSS
0.3%
top 46.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 17
Latest updateJul 18
Description
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver …
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages4 packages
Also affects: Debian Linux 10.0
Patches
🔴Vulnerability Details
2📋Vendor Advisories
4Microsoft▶
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings incorrect username_filter and mec↗2022-07-12
Red Hat
▶
Debian▶
CVE-2022-30550: dovecot - An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3....↗2022