« Volver al listado

CVE-2010-3304

Estado: ModificadaMedia (6.4)—

The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dovecot — Dovecot

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-3304",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-09-24T19:00:04.980",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/43220",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.dovecot.org/list/dovecot-news/2010-July/000163.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:217",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2010/09/16/14",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2010/09/16/17",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/41964",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1059-1",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/2840",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2011/0301",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/43220",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.dovecot.org/list/dovecot-news/2010-July/000163.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:217",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2010/09/16/14",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2010/09/16/17",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/41964",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1059-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/2840",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2011/0301",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs."
    },
    {
      "lang": "es",
      "value": "El complemento ACL de Dovecot v1.2.x anteriores a v1.2.13 propaga las ACLs INBOX a nuevos buzones de correo en determinadas configuraciones, lo que puede permitir a atacantes remotos leer buzones de correo que tienen ACLs débiles imprevistos."
    }
  ],
  "lastModified": "2026-06-16T23:22:33.020",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD2D1C99-0594-4378-AA6C-EC2E890E41FA"
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "96F35305-79B4-49CD-A89F-A559CA9EEB33"
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDC7E277-A5AE-4025-8412-E715D1C8C0F9"
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0DBE1D51-B9D5-4E59-81F6-C6937DA78637"
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "30B37ACE-64EA-49E7-B836-C3F05CAE0392"
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1204F5C2-916D-4C27-A5C4-5B5E0AAA7322"
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.2.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0C46C8A-EA49-4356-BA6B-8EC0F2E70B3B"
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.2.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "96F54038-B17B-40C0-9C2E-20AF55E7602B"
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.2.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBB0B72A-1C7D-4F89-BE89-CD82F667CB76"
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.2.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FEF89EB6-CBF5-48DF-8FDD-2C0AE0266B3D"
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.2.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41B2B3D8-EB69-4BD8-ACD5-CB6BFDE6B2FB"
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.2.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1A909DC-0D77-4690-87D2-51A7564B63B8"
            },
            {
              "criteria": "cpe:2.3:a:dovecot:dovecot:1.2.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB2F767F-5D7F-40AC-BA57-4E819F486301"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}