Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

EServ/3 IMAP service lets authenticated users read others' email

CVE-2006-2308 · published 20 years ago
Summary

The IMAP component of EServ/3 version 3.25 can be tricked by logged‑in users into accessing files outside their own mailbox. This lets them view other users' messages and create, rename or delete folders on the server. Apply the vendor's update or restrict IMAP access to trusted users until the fix is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
etype eserv 3.0
3.25
cpe:2.3:a:etype:eserv:3.0:*:*:*:*:*:*:*
Original advisory text
Directory traversal vulnerability in the IMAP service in EServ/3 3.25 allows remote authenticated users to read other user's email messages, create/rename arbitrary directories on the system, and d...
Directory traversal vulnerability in the IMAP service in EServ/3 3.25 allows remote authenticated users to read other user's email messages, create/rename arbitrary directories on the system, and delete empty directories via directory traversal sequences in the (1) CREATE, (2) SELECT, (3) DELETE, (4) RENAME, (5) COPY or (6) APPEND commands.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.5 Medium
Exploitation
2% chance of attack within 30 days
Timeline
Published2 Jun 2006
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2006-2308 · NVD
Track software like this
Free during beta