CVE-2020-24386

An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this flaw, ensure that imap_hibernate_timeout is set to 0 or not set at all/commented out in both /etc/dovecot/dovecot.conf or /etc/dovecot/conf.d/20-imap.conf.