CVE-2010-3707 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2010-3707 Interim 1 5 2023-12-09T01:54:41Z current 2021-05-30T12:54:01Z 2023-12-09T01:54:41Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2010-3707 plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving more specific entries that occur after less specific entries, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MOIEDREROIMRGBCEM4AQRCTMZ7TT4MR4/#MOIEDREROIMRGBCEM4AQRCTMZ7TT4MR4 E-Mail link for SUSE-SR:2010:020 https://www.suse.com/support/security/rating/ SUSE Security Ratings plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving more specific entries that occur after less specific entries, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox. CVE-2010-3707 moderate 5.5 AV:N/AC:L/Au:S/C:P/I:P/A:N