CVE-2008-1218
Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters, which are treated as argument delimiters that enable the skip_password_check field to be specified.
- Affected products
- Dovecot
- Dovecot
- ≤ 1.0.12, 1.1
- Fix
- Available
- CVSS 2.0
- 6.8 MEDIUM
- EPSS
- 7.3% (94th percentile)
- Weakness
- CWE-255
- NVD status
- Modified
- Published
- 2008-03-10
CVE-2008-1218 at NVD
6 known exploits for CVE-2008-1218
Proof-of-concept code and exploit modules indexed by Sploitus
Dovecot IMAP 1.0.10 <= 1.1rc2 - Remote Email Disclosure Exploit
dovecot-disclose.txt
Dovecot IMAP 1.0.10 <= 1.1rc2 Remote Email Disclosure Exploit
Dovecot IMAP 1.0.10 <= 1.1rc2 Remote Email Disclosure Exploit
Dovecot IMAP 1.0.10 1.1rc2 - Remote Email Disclosure
Dovecot IMAP 1.0.10 < 1.1rc2 - Remote Email Disclosure