Vulnerability Details : CVE-2022-30550
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
Vulnerability category: Gain privilege
Products affected by CVE-2022-30550
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*
- cpe:2.3:a:dovecot:dovecot:2.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-30550
0.36%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 72 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-30550
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2024-10-15 |
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2022-30550
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-30550
-
https://dovecot.org/security
SecurityVendor Advisory
-
https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html
[SECURITY] [DLA 3122-1] dovecot security updateMailing List;Third Party Advisory
-
https://security.gentoo.org/glsa/202310-19
Dovecot: Privilege Escalation (GLSA 202310-19) — Gentoo securityThird Party Advisory
-
https://www.dovecot.org/download/
Dovecot | DownloadProduct
-
https://www.openwall.com/lists/oss-security/2022/07/08/1
oss-security - Re: CVE-2022-30550: Privilege escalation possible in dovecot when similar master and non-master passdbs are usedMailing List;Patch;Third Party Advisory
Jump to