Open-Xchange Dovecot SQL Authentication Bypass Vulnerability

A vulnerability exists in Open-Xchange Dovecot SQL-based authentication that allows authentication to be bypassed and user enumeration to occur. This issue arises when the 'auth_username_chars' parameter is cleared by an administrator. The vulnerability affects multiple versions of Open-Xchange Dovecot Pro and Open-Xchange Dovecot CE.

Impact

Exploiting this vulnerability bypasses authentication for all users and allows for user enumeration.

Remediation

Administrators are advised not to clear the 'auth_username_chars' setting. If it has already been cleared, the latest fixed version should be installed.