CVE-2020-24386

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.3.13

Description The issue is related to the improper neutralization of control and meta characters in the Dovecot mail server, allowing a remote attacker to access and compromise confidential data. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages and path disclosure.

Recommendations For versions prior to 2.3.13, update to version 2.3.13 or later to resolve the issue. As a temporary workaround, consider restricting access to IMAP IDLE functionality until a patch is applied. Avoid using attacker-controlled parameters in IMAP IDLE to minimize the risk of exploitation.