CVE-2017-14461 MEDIUM

CVE-2017-14461

Vendor The Dovecot Project
Product Dovecot
Weakness CWE-125
Published March 2, 2018
Last update September 16, 2024

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H

What the vulnerability does

01Description

A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.

Key dates

02Disclosure timeline

March 2, 2018 CVE published
September 16, 2024 Record updated