VDB
CVE-2008-1218
CVE-2008-1218
PUBLISHED
CVSS 6.800000190734863 MEDIUM
Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters, which are treated as argument delimiters that enable the skip_password_check field to be specified.
EPSS 7.34% · 94.3th percentile
Risk Scores
CVSS 2.0
6.800000190734863
EPSS Score
7.34%
94.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| dovecot | dovecot | 0, 0 |
Timeline
- Mar 10, 2008 CVE Published
- Mar 14, 2008 PoC Published
- Mar 14, 2008 PoC Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- Jul 13, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Dec 19, 2022 EPSS Score
- Feb 10, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- May 27, 2023 EPSS Score
- Jul 19, 2023 EPSS Score
References
- GLSA-200803-25 vendor-advisory
- dovecot-tab-authentication-bypass(41085) vdb
- 29557 third-party-advisory
- DSA-1516 vendor-advisory
- USN-593-1 vendor-advisory
- 29364 third-party-advisory
- SUSE-SR:2008:020 vendor-advisory
- [Dovecot-news] 20080309 Security hole #6: Some passdbs allowed users to log in without a valid password mailing-list
- 20080312 rPSA-2008-0108-1 dovecot mailing-list
- 29385 third-party-advisory
- 28181 vdb
- 29396 third-party-advisory
- 29295 third-party-advisory
- 5257 exploit
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0108 url
- FEDORA-2008-2475 vendor-advisory
- https://issues.rpath.com/browse/RPL-2341 url
- [Dovecot-news] 20080309 v1.0.13 and v1.1.rc3 released mailing-list
- 29226 third-party-advisory
- 32151 third-party-advisory
…and 3 more