CVEvulnerability

CVE-2009-3897

5.5 MEDIUM Published 2009-11-24 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-11-24
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-732

Description

Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself.

Affected configurations

• dovecot dovecot (>= 1.2.0 < 1.2.8)

Related

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

Referenced by CWE · observed example (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References