CVE-2010-3304
The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in...
The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs.
Exploit likelihood
What each source reports
NVD Score used
The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs.
- Record
CVE-2010-3304- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs.
- Record
CVE-2010-3304- Updated
- 2026-11-02
EUVDEUVD-2010-3302 No score
The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs.
- Record
EUVD-2010-3302- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8j3r-92hg-4567 No score
The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in...
The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs.
- Record
GHSA-8j3r-92hg-4567- Updated
- 2026-11-02
OSV No score
The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs.
- Record
CVE-2010-3304- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-3304 No score
The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs.
- Record
DEBIAN-CVE-2010-3304- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-3304 is a medium vulnerability (CVSS 6.4) in Dovecot, published September 24, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.71%, the 86th percentile. Fixed in dovecot 1.2.13-1.
References
dovecot.org/list/dovecot-news/2010-July/000163.html
openwall.com/lists/oss-security/2010/09/16/17
ubuntu.com/usn/USN-1059-1
securityfocus.com/bid/41964
mandriva.com/security/advisories?name=MDVSA-2010:217