VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 4, 2021· Updated Aug 4, 2024

CVE-2020-24386

CVE-2020-24386

Description

Authenticated Dovecot users can access other users' emails via crafted IMAP IDLE commands in versions before 2.3.13.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Authenticated Dovecot users can access other users' emails via crafted IMAP IDLE commands in versions before 2.3.13.

Vulnerability

Dovecot versions 2.2.26 through 2.3.11.3 are vulnerable to CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences in the IMAP hibernation component. When IMAP hibernation is enabled (imap_hibernate_timeout > 0), an authenticated attacker can send a specially crafted IMAP IDLE command that triggers unhibernation with attacker-controlled parameters, causing Dovecot to incorrectly associate the session with another user's mailbox [1][2].

Exploitation

An attacker must have valid credentials to authenticate to the Dovecot IMAP server. With no additional network privileges, the attacker sends a crafted IMAP IDLE command that manipulates the unhibernation process. This causes Dovecot to restore a session that belongs to a different user, allowing the attacker to interact with that user's mailbox [1][2].

Impact

Successful exploitation enables the attacker to read other users' email messages and discover filesystem path information, leading to unauthorized disclosure of sensitive data and potential further compromise. The vulnerability has a CVSS score of 8.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), indicating high impact on confidentiality and integrity [1][2].

Mitigation

The issue is fixed in Dovecot version 2.3.13, released on 2020-08-27 [1][2]. As a workaround, administrators can disable IMAP hibernation by setting imap_hibernate_timeout = 0 or leaving it unset (default is disabled) [2]. Users should upgrade to 2.3.13 or later to fully address the vulnerability.

References
  1. security - CVE-2020-24386: Dovecot: IMAP hibernation allows accessing other peoples mail
  2. [Dovecot-news] CVE-2020-24386: IMAP hibernation allows accessing other peoples mail

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

35

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

9

News mentions

0

No linked articles in our index yet.