Every CVE Search/ Get API key

CVE-2007-6598

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not...

6.8 MediumFix available

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.

Exploit likelihood

1.96%Down 2.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.

Record
CVE-2007-6598
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.

Record
CVE-2007-6598
Updated
2026-11-02
EUVDEUVD-2007-6564 No score

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.

Record
EUVD-2007-6564
Updated
2026-11-03
GitHub AdvisoriesGHSA-grp6-gcpf-v967 No score

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not...

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.

Record
GHSA-grp6-gcpf-v967
Updated
2026-11-02
OSV No score

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.

Record
CVE-2007-6598
Updated
2026-11-02
OSVDEBIAN-CVE-2007-6598 No score

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.

Record
DEBIAN-CVE-2007-6598
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dovecot
Debian:12
 before 1:1.0.10-1
1:1.0.10-1
dovecot
Debian:13
 before 1:1.0.10-1
1:1.0.10-1
dovecot
Debian:14
 before 1:1.0.10-1
1:1.0.10-1
dovecot
Debian:4.0
 before 1.0.rc15-2etch3, plus listed versions
1.0.rc15-21.0.rc15-2etch11.0.rc15-2etch2
1.0.rc15-2etch3
dovecot
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.0.7-2.el5
0:1.0.7-2.el5
dovecot-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.0.7-2.el5
0:1.0.7-2.el5
dovecot
Red Hat:enterprise_linux:5::server
 before 0:1.0.7-2.el5
0:1.0.7-2.el5
dovecot-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:1.0.7-2.el5
0:1.0.7-2.el5

History

History
RecordedChangedSources
aliasesEUVD
affected, aliases, facts, references, titleGitHub Advisories, OSV
first indexedCVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-6598 is a medium vulnerability (CVSS 6.8) in Dovecot, published January 4, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.96%, the 80th percentile. Fixed in dovecot 1:1.0.10-1.

References

Show 38 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open