Back to Database
Status published
Medium
CVE-2007-2231
Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when...
Vulnerability Description
Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-2231
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.ubuntu.com/usn/usn-487-1
- http://secunia.com/advisories/30342
- http://www.redhat.com/support/errata/RHSA-2008-0297.html
- http://www.securityfocus.com/bid/23552
- http://www.debian.org/security/2007/dsa-1359
- http://dovecot.org/doc/NEWS
- http://dovecot.org/list/dovecot-cvs/2007-March/008488.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10995
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34082
- http://www.novell.com/linux/security/advisories/2007_8_sr.html
- http://www.vupen.com/english/advisories/2007/1452
- http://dovecot.org/list/dovecot-news/2007-March/000038.html
- http://secunia.com/advisories/25072
- http://www.securityfocus.com/archive/1/466168/100/0/threaded
More from dovecot
View All →CVE-2022-30550
An issue was discovered in the auth component in Dovecot...
Unknown
0
CVE-2021-33515
The submission service in Dovecot before 2.3.15 allows STARTTLS command...
Medium
4.8
CVE-2021-29157
Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with...
High
7.5
CVE-2020-7957
The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3...
Low
3.1
CVE-2020-7046
lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3...
High
7.5
Affected Vendor
dovecot
View all reports →Affected Software
dovecot
Vulnerable Versions:
1.0.beta1, 1.0.beta2, 1.0.beta3, 1.0.beta4, 1.0.beta5, 1.0.beta6, 1.0.beta7, 1.0.beta8, 1.0.beta9, 1.0.rc1, 1.0.rc2, 1.0.rc3, 1.0.rc4, 1.0.rc5, 1.0.rc6, 1.0.rc7, 1.0.rc8, 1.0.rc9, 1.0.rc10, 1.0.rc11, 1.0.rc12, 1.0.rc13, 1.0.rc14, 1.0.rc15, 1.0.rc16, 1.0.rc17, 1.0.rc18, 1.0.rc19, 1.0.rc20, 1.0.rc21, 1.0.rc22, 1.0.rc23, 1.0.rc24, 1.0.rc25, 1.0.rc26, 1.0.rc27, 1.0.rc28
Timeline
Official Publish:
April 25th, 2007
Last Modified:
August 7th, 2024
Added to House:
July 18th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.